xworm | 585d1fb4f288974b683c5abfb10c97d7d2ae3f59c2bcfd78ba272e3be2cd7815

Analysis

max time kernel
176s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2024 11:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

msfiler.exe
Size

419KB
MD5

8a716466aa6f2d425ec09770626e8e54
SHA1

62fb757ea5098651331f91c1664db9fe46b21879
SHA256

585d1fb4f288974b683c5abfb10c97d7d2ae3f59c2bcfd78ba272e3be2cd7815
SHA512

54f11067e400347834689b4532ae53b00ec96a3ca90a2c21de27942f4ca30306fdda0522c1a3a4cde047ad650162e2d8313205220acaab4cc60e010965690940
SSDEEP

6144:QTCsE3O4yuS5O0RBOInaCa6G6ypdf4Bf7e/DnjBeq04fVXOUvE0CGsSE9BLM:2E3O5uOO0mInnGZCTS84fZLtw

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

5.182.87.154:7000

Mutex

VMFidhoqn75fm5lJ

Attributes

Install_directory
%Temp%
install_file
mdnsresp.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4428-10-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	msfiler.exe
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	msfiler.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mdnsresp.lnk	msfiler.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mdnsresp.lnk	msfiler.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2604 set thread context of 4428	2604	msfiler.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4588	powershell.exe
4588	powershell.exe
4060	powershell.exe
4060	powershell.exe
2324	powershell.exe
2324	powershell.exe
2652	powershell.exe
2652	powershell.exe
3592	powershell.exe
3592	powershell.exe
4428	msfiler.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2604	msfiler.exe
Token: SeDebugPrivilege	4428	msfiler.exe
Token: SeDebugPrivilege	4588	powershell.exe
Token: SeDebugPrivilege	4060	powershell.exe
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeDebugPrivilege	2652	powershell.exe
Token: SeDebugPrivilege	3592	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4428	msfiler.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 4588	2604	msfiler.exe	92
PID 2604 wrote to memory of 4588	2604	msfiler.exe	92
PID 2604 wrote to memory of 4588	2604	msfiler.exe	92
PID 2604 wrote to memory of 4428	2604	msfiler.exe	94
PID 2604 wrote to memory of 4428	2604	msfiler.exe	94
PID 2604 wrote to memory of 4428	2604	msfiler.exe	94
PID 2604 wrote to memory of 4428	2604	msfiler.exe	94
PID 2604 wrote to memory of 4428	2604	msfiler.exe	94
PID 2604 wrote to memory of 4428	2604	msfiler.exe	94
PID 2604 wrote to memory of 4428	2604	msfiler.exe	94
PID 2604 wrote to memory of 4428	2604	msfiler.exe	94
PID 4428 wrote to memory of 4060	4428	msfiler.exe	95
PID 4428 wrote to memory of 4060	4428	msfiler.exe	95
PID 4428 wrote to memory of 4060	4428	msfiler.exe	95
PID 4428 wrote to memory of 2324	4428	msfiler.exe	98
PID 4428 wrote to memory of 2324	4428	msfiler.exe	98
PID 4428 wrote to memory of 2324	4428	msfiler.exe	98
PID 4428 wrote to memory of 2652	4428	msfiler.exe	101
PID 4428 wrote to memory of 2652	4428	msfiler.exe	101
PID 4428 wrote to memory of 2652	4428	msfiler.exe	101
PID 4428 wrote to memory of 3592	4428	msfiler.exe	102
PID 4428 wrote to memory of 3592	4428	msfiler.exe	102
PID 4428 wrote to memory of 3592	4428	msfiler.exe	102

C:\Users\Admin\AppData\Local\Temp\msfiler.exe
"C:\Users\Admin\AppData\Local\Temp\msfiler.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAbQBzAGYAaQBsAGUAcgAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAbQBzAGYAaQBsAGUAcgAuAGUAeABlADsA
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4588
- C:\Users\Admin\AppData\Local\Temp\msfiler.exe
  C:\Users\Admin\AppData\Local\Temp\msfiler.exe
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msfiler.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4060
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msfiler.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2324
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\mdnsresp.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2652
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'mdnsresp.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\msfiler.exe.log

Filesize
1KB

MD5
8c2da65103d6b46d8cf610b118210cf0

SHA1
9db4638340bb74f2af3161cc2c9c0b8b32e6ab65

SHA256
0e48e2efd419951e0eb9a8d942493cfdf5540d1d19ff9dae6f145fb3ebcbeeac

SHA512
3cf5a125276e264cd8478f2b92d3848fb68b96d46eb4a39e650d09df02068c274881a1c314cdfbfdcb452672fb70dd8becf3ffe9562d39919d9c4d6b07fbb614

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
31f8c58a6310917f0ba141b9fe162739

SHA1
0363abeaf5e23cff350f95d141811dbc2cfdb6fa

SHA256
dd47b0f3e3950cf8c0b6ab4130c51cbe38878e1b14647d66b8fd5011ff6c1475

SHA512
204a25c7053eb681ce9334cf4dd851bfa3cae906e56ce58250de9d97e6e1fbcd12b9704b9e2d22c2f071f5e0de28c7eb126c29d2d5d337a30a79ec4170ee2728

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
e6593d9702ae2b44fd29532001ffcce9

SHA1
ae166fb9e680ae6d0037cf3c21ec5e9abdda9eaf

SHA256
c051baf8ba4153f8d9acb2c247c42d223c97179b9df478055851d6514c612b72

SHA512
960b1f3869a4b43c4c61e4955f50d8eff16a1492cbebc6eff630a1b245c89817ae61838366c08539f3c337c381c5d6852fa0e420a1524dd68c471f35bb8185f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
0744d32d5fca236c968fa8003c146c1b

SHA1
d53613ca314560f607d3d5c656c444ec27970928

SHA256
6a1ac6f6bc7d1d983b18c4060feeb786e2b2d6136b29c450101c67db8829935f

SHA512
bbcdcab740d6ba114b1c51327dd7f5571c25883632ef6e5ae72208d239f8667c3e616eee128963401347fcb54d4f79eb54a1c1c28c262dbcc06928ab675941e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dm3ozhpy.ftc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2324-107-0x0000000070980000-0x00000000709CC000-memory.dmp

Filesize
304KB

Download
memory/2324-118-0x0000000007800000-0x0000000007811000-memory.dmp

Filesize
68KB

Download
memory/2324-119-0x0000000007830000-0x0000000007844000-memory.dmp

Filesize
80KB

Download
memory/2324-121-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Filesize
7.7MB

Download
memory/2324-92-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Filesize
7.7MB

Download
memory/2324-105-0x0000000006300000-0x000000000634C000-memory.dmp

Filesize
304KB

Download
memory/2324-94-0x0000000002980000-0x0000000002990000-memory.dmp

Filesize
64KB

Download
memory/2324-117-0x0000000007550000-0x00000000075F3000-memory.dmp

Filesize
652KB

Download
memory/2324-93-0x0000000002980000-0x0000000002990000-memory.dmp

Filesize
64KB

Download
memory/2324-106-0x000000007F2B0000-0x000000007F2C0000-memory.dmp

Filesize
64KB

Download
memory/2604-4-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

Filesize
64KB

Download
memory/2604-0-0x00000000005C0000-0x0000000000630000-memory.dmp

Filesize
448KB

Download
memory/2604-3-0x0000000004ED0000-0x0000000004F62000-memory.dmp

Filesize
584KB

Download
memory/2604-15-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Filesize
7.7MB

Download
memory/2604-2-0x0000000005570000-0x0000000005B14000-memory.dmp

Filesize
5.6MB

Download
memory/2604-1-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Filesize
7.7MB

Download
memory/2604-7-0x00000000051A0000-0x00000000051D0000-memory.dmp

Filesize
192KB

Download
memory/2604-5-0x0000000004F90000-0x0000000004F9A000-memory.dmp

Filesize
40KB

Download
memory/2604-6-0x0000000005150000-0x0000000005198000-memory.dmp

Filesize
288KB

Download
memory/2604-9-0x0000000005220000-0x000000000526C000-memory.dmp

Filesize
304KB

Download
memory/2604-8-0x00000000051D0000-0x0000000005200000-memory.dmp

Filesize
192KB

Download
memory/2652-147-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Filesize
7.7MB

Download
memory/2652-124-0x00000000049F0000-0x0000000004A00000-memory.dmp

Filesize
64KB

Download
memory/2652-123-0x00000000049F0000-0x0000000004A00000-memory.dmp

Filesize
64KB

Download
memory/2652-122-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Filesize
7.7MB

Download
memory/2652-135-0x000000007FA90000-0x000000007FAA0000-memory.dmp

Filesize
64KB

Download
memory/2652-136-0x0000000070980000-0x00000000709CC000-memory.dmp

Filesize
304KB

Download
memory/4060-63-0x0000000004F00000-0x0000000004F10000-memory.dmp

Filesize
64KB

Download
memory/4060-80-0x0000000007970000-0x000000000797E000-memory.dmp

Filesize
56KB

Download
memory/4060-37-0x0000000004F00000-0x0000000004F10000-memory.dmp

Filesize
64KB

Download
memory/4060-36-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Filesize
7.7MB

Download
memory/4060-83-0x0000000007A60000-0x0000000007A68000-memory.dmp

Filesize
32KB

Download
memory/4060-82-0x0000000007A80000-0x0000000007A9A000-memory.dmp

Filesize
104KB

Download
memory/4060-66-0x000000007EE40000-0x000000007EE50000-memory.dmp

Filesize
64KB

Download
memory/4060-38-0x0000000004F00000-0x0000000004F10000-memory.dmp

Filesize
64KB

Download
memory/4060-67-0x00000000704E0000-0x000000007052C000-memory.dmp

Filesize
304KB

Download
memory/4060-89-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Filesize
7.7MB

Download
memory/4060-81-0x0000000007980000-0x0000000007994000-memory.dmp

Filesize
80KB

Download
memory/4428-91-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Filesize
7.7MB

Download
memory/4428-10-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4428-13-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Filesize
7.7MB

Download
memory/4428-14-0x0000000005300000-0x000000000539C000-memory.dmp

Filesize
624KB

Download
memory/4588-17-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Filesize
7.7MB

Download
memory/4588-79-0x00000000078A0000-0x00000000078B1000-memory.dmp

Filesize
68KB

Download
memory/4588-90-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Filesize
7.7MB

Download
memory/4588-78-0x0000000007920000-0x00000000079B6000-memory.dmp

Filesize
600KB

Download
memory/4588-77-0x0000000007710000-0x000000000771A000-memory.dmp

Filesize
40KB

Download
memory/4588-65-0x00000000076B0000-0x00000000076CA000-memory.dmp

Filesize
104KB

Download
memory/4588-64-0x0000000007D10000-0x000000000838A000-memory.dmp

Filesize
6.5MB

Download
memory/4588-62-0x00000000075E0000-0x0000000007683000-memory.dmp

Filesize
652KB

Download
memory/4588-61-0x0000000006950000-0x000000000696E000-memory.dmp

Filesize
120KB

Download
memory/4588-51-0x00000000704E0000-0x000000007052C000-memory.dmp

Filesize
304KB

Download
memory/4588-50-0x0000000006990000-0x00000000069C2000-memory.dmp

Filesize
200KB

Download
memory/4588-49-0x000000007FB30000-0x000000007FB40000-memory.dmp

Filesize
64KB

Download
memory/4588-48-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/4588-35-0x0000000006440000-0x000000000648C000-memory.dmp

Filesize
304KB

Download
memory/4588-34-0x0000000006380000-0x000000000639E000-memory.dmp

Filesize
120KB

Download
memory/4588-33-0x0000000005EE0000-0x0000000006234000-memory.dmp

Filesize
3.3MB

Download
memory/4588-28-0x0000000005D70000-0x0000000005DD6000-memory.dmp

Filesize
408KB

Download
memory/4588-22-0x0000000005C90000-0x0000000005CF6000-memory.dmp

Filesize
408KB

Download
memory/4588-21-0x00000000054B0000-0x00000000054D2000-memory.dmp

Filesize
136KB

Download
memory/4588-20-0x0000000005530000-0x0000000005B58000-memory.dmp

Filesize
6.2MB

Download
memory/4588-19-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/4588-18-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/4588-16-0x0000000004DC0000-0x0000000004DF6000-memory.dmp

Filesize
216KB

Download