xworm | cce8c96ff44ec0460c63c2f98174d93d816c1bc34084b4de954883509c136cb9

Reason

Machine shutdown

General

Target

TrumpWareCracked.exe
Size

1.5MB
MD5

e93c683c91accbed9badc10aa9ec5ede
SHA1

0204ba8fd3bd82277edfec5278174fffe0f87b69
SHA256

cce8c96ff44ec0460c63c2f98174d93d816c1bc34084b4de954883509c136cb9
SHA512

097c7afcfd3f639dcd321698deeb338fab694b771a8bb0daf9da82bef523ab413a9fcfabf96a3e9b6bca7c3883aa9c1592c0c5e74d2b385b4718b6336a5e77ec
SSDEEP

24576:Mb7wuqCqK3Gt6UGMSqH5/92yltT+20ZYOiGZujKRdKvVLu/mEcO:ecuVq88oqZ12uhOiGYO8v0uF

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

C2

0.tcp.ngrok.io:11754

Attributes

Install_directory
%AppData%
install_file
bestfncheatout.exe

Signatures

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012321-2.dat	family_xworm
behavioral1/memory/284-16-0x0000000000970000-0x0000000000988000-memory.dmp	family_xworm
behavioral1/memory/2156-18-0x0000000002800000-0x0000000002840000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bestfncheatout.lnk	54.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bestfncheatout.lnk	54.exe

Executes dropped EXE 2 IoCs

pid	Process
284	54.exe
2792	Archive.exe

Loads dropped DLL 3 IoCs

pid	Process
2500	TrumpWareCracked.exe
2500	TrumpWareCracked.exe
2812	Process not Found

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
6	0.tcp.ngrok.io

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\IME\Archive.dll	Archive.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
2792	Archive.exe
2792	Archive.exe
2156	powershell.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe
2792	Archive.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	284	54.exe
Token: SeDebugPrivilege	2156	powershell.exe
Token: SeShutdownPrivilege	1284	shutdown.exe
Token: SeRemoteShutdownPrivilege	1284	shutdown.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2156	2500	TrumpWareCracked.exe	28
PID 2500 wrote to memory of 2156	2500	TrumpWareCracked.exe	28
PID 2500 wrote to memory of 2156	2500	TrumpWareCracked.exe	28
PID 2500 wrote to memory of 2156	2500	TrumpWareCracked.exe	28
PID 2500 wrote to memory of 284	2500	TrumpWareCracked.exe	30
PID 2500 wrote to memory of 284	2500	TrumpWareCracked.exe	30
PID 2500 wrote to memory of 284	2500	TrumpWareCracked.exe	30
PID 2500 wrote to memory of 284	2500	TrumpWareCracked.exe	30
PID 2500 wrote to memory of 2792	2500	TrumpWareCracked.exe	31
PID 2500 wrote to memory of 2792	2500	TrumpWareCracked.exe	31
PID 2500 wrote to memory of 2792	2500	TrumpWareCracked.exe	31
PID 2500 wrote to memory of 2792	2500	TrumpWareCracked.exe	31
PID 284 wrote to memory of 1284	284	54.exe	36
PID 284 wrote to memory of 1284	284	54.exe	36
PID 284 wrote to memory of 1284	284	54.exe	36

C:\Users\Admin\AppData\Local\Temp\TrumpWareCracked.exe
"C:\Users\Admin\AppData\Local\Temp\TrumpWareCracked.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAYwBzACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG4AegBsACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcARgBvAHIAdABuAGkAdABlACAAbABvAGEAZABlAGQAJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAHYAcQBqACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2156
- C:\Users\Admin\AppData\Roaming\54.exe
  "C:\Users\Admin\AppData\Roaming\54.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:284
- - C:\Windows\system32\shutdown.exe
    shutdown.exe /f /s /t 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1284
- C:\Users\Admin\AppData\Local\Temp\Archive.exe
  "C:\Users\Admin\AppData\Local\Temp\Archive.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2792

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2072

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Archive.exe

Filesize
1.4MB

MD5
fd8e566d88637434734ccd92a7d865fa

SHA1
0f11ce240cfddb9e83388678a1a0217a568ccd2c

SHA256
aaff12ff60520346cc72bb89fb2b879edfaf187e32e821a1486c6b5771eaa687

SHA512
610bfc4851358f281e88fb351724d54f6b4eea23723930ce7d0fa46b04d405d6457b90b58f9112539912e22a55d8ea3d26f52d94c90124cd13864b5fd01a0bcc

Download Submit
\Users\Admin\AppData\Roaming\54.exe

Filesize
67KB

MD5
6bc653a861c9b0373b6ea77d44c4bdca

SHA1
c88a4840526c17dd7b262e906bd40e203b2a01d7

SHA256
160aa835c7653817192e3ec22a96c82a53e35742ceb101f4d34f4227912664e0

SHA512
5ae5232122eb023bec0545ee7ef62e70240bbb4d90bb7d023582f3025ac741760c02445cf0e6dfe255aa3008b59bc56ab0cbc763db91896a4aa1f67101c9fed3

Download Submit
memory/284-30-0x00000000020C0000-0x00000000020CA000-memory.dmp

Filesize
40KB

Download
memory/284-16-0x0000000000970000-0x0000000000988000-memory.dmp

Filesize
96KB

Download
memory/284-17-0x000007FEF5C80000-0x000007FEF666C000-memory.dmp

Filesize
9.9MB

Download
memory/284-35-0x000007FEF5C80000-0x000007FEF666C000-memory.dmp

Filesize
9.9MB

Download
memory/284-32-0x00000000020E0000-0x00000000020EC000-memory.dmp

Filesize
48KB

Download
memory/284-23-0x000000001B0D0000-0x000000001B150000-memory.dmp

Filesize
512KB

Download
memory/284-31-0x000000001B0D0000-0x000000001B150000-memory.dmp

Filesize
512KB

Download
memory/284-29-0x000007FEF5C80000-0x000007FEF666C000-memory.dmp

Filesize
9.9MB

Download
memory/1684-36-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/2072-34-0x0000000002D90000-0x0000000002D91000-memory.dmp

Filesize
4KB

Download
memory/2156-18-0x0000000002800000-0x0000000002840000-memory.dmp

Filesize
256KB

Download
memory/2156-24-0x0000000073F30000-0x00000000744DB000-memory.dmp

Filesize
5.7MB

Download
memory/2156-20-0x0000000002800000-0x0000000002840000-memory.dmp

Filesize
256KB

Download
memory/2156-22-0x0000000073F30000-0x00000000744DB000-memory.dmp

Filesize
5.7MB

Download
memory/2156-21-0x0000000002800000-0x0000000002840000-memory.dmp

Filesize
256KB

Download
memory/2156-19-0x0000000073F30000-0x00000000744DB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

Errors