xworm | 986f5d92d64819c88ae6b48f2151cc780eb0aabe7d88bd488061f5efc48588fb

Resubmissions

08-02-2024 03:17

240208-ds6mzsdhcp 10

08-02-2024 03:05

240208-dlmxascc26 10

Analysis

max time kernel
147s
max time network
153s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
08-02-2024 03:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

windows.exe
Size

332KB
MD5

21b941b814ff8935b0f5b308a8c7ec9c
SHA1

568e4c957b15f002eebb0bb291537e4c36c8f390
SHA256

986f5d92d64819c88ae6b48f2151cc780eb0aabe7d88bd488061f5efc48588fb
SHA512

dc486028a9d29f8e37454b38928222a932134ab2534b8bdf191ddd7e85da4edf39802e21de1af6de061b20a162ac14440d43320f8837f927e8e9ea354567ed18
SSDEEP

6144:rd4bYBotL3mIhs8DyFPd4U1mGvEMdn7Ml/wCmCJ:rd4EBCqL4RpMi9XmCJ

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

hai1723rat-60039.portmap.io:60039

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/3412-116-0x0000000001360000-0x0000000001378000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Executes dropped EXE 1 IoCs

pid	Process
3412	pcnetwork.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\pcnetwork.exe	windows.exe
File opened for modification	C:\Windows\pcnetwork.exe	windows.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1212	timeout.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2316	powershell.exe
2316	powershell.exe
2316	powershell.exe
3672	powershell.exe
3672	powershell.exe
3672	powershell.exe
4552	powershell.exe
4552	powershell.exe
4552	powershell.exe
200	powershell.exe
200	powershell.exe
200	powershell.exe
3412	pcnetwork.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2224	windows.exe
Token: SeDebugPrivilege	2316	powershell.exe
Token: SeIncreaseQuotaPrivilege	2316	powershell.exe
Token: SeSecurityPrivilege	2316	powershell.exe
Token: SeTakeOwnershipPrivilege	2316	powershell.exe
Token: SeLoadDriverPrivilege	2316	powershell.exe
Token: SeSystemProfilePrivilege	2316	powershell.exe
Token: SeSystemtimePrivilege	2316	powershell.exe
Token: SeProfSingleProcessPrivilege	2316	powershell.exe
Token: SeIncBasePriorityPrivilege	2316	powershell.exe
Token: SeCreatePagefilePrivilege	2316	powershell.exe
Token: SeBackupPrivilege	2316	powershell.exe
Token: SeRestorePrivilege	2316	powershell.exe
Token: SeShutdownPrivilege	2316	powershell.exe
Token: SeDebugPrivilege	2316	powershell.exe
Token: SeSystemEnvironmentPrivilege	2316	powershell.exe
Token: SeRemoteShutdownPrivilege	2316	powershell.exe
Token: SeUndockPrivilege	2316	powershell.exe
Token: SeManageVolumePrivilege	2316	powershell.exe
Token: 33	2316	powershell.exe
Token: 34	2316	powershell.exe
Token: 35	2316	powershell.exe
Token: 36	2316	powershell.exe
Token: SeDebugPrivilege	3672	powershell.exe
Token: SeIncreaseQuotaPrivilege	3672	powershell.exe
Token: SeSecurityPrivilege	3672	powershell.exe
Token: SeTakeOwnershipPrivilege	3672	powershell.exe
Token: SeLoadDriverPrivilege	3672	powershell.exe
Token: SeSystemProfilePrivilege	3672	powershell.exe
Token: SeSystemtimePrivilege	3672	powershell.exe
Token: SeProfSingleProcessPrivilege	3672	powershell.exe
Token: SeIncBasePriorityPrivilege	3672	powershell.exe
Token: SeCreatePagefilePrivilege	3672	powershell.exe
Token: SeBackupPrivilege	3672	powershell.exe
Token: SeRestorePrivilege	3672	powershell.exe
Token: SeShutdownPrivilege	3672	powershell.exe
Token: SeDebugPrivilege	3672	powershell.exe
Token: SeSystemEnvironmentPrivilege	3672	powershell.exe
Token: SeRemoteShutdownPrivilege	3672	powershell.exe
Token: SeUndockPrivilege	3672	powershell.exe
Token: SeManageVolumePrivilege	3672	powershell.exe
Token: 33	3672	powershell.exe
Token: 34	3672	powershell.exe
Token: 35	3672	powershell.exe
Token: 36	3672	powershell.exe
Token: SeDebugPrivilege	3412	pcnetwork.exe
Token: SeDebugPrivilege	3412	pcnetwork.exe
Token: SeDebugPrivilege	4552	powershell.exe
Token: SeIncreaseQuotaPrivilege	4552	powershell.exe
Token: SeSecurityPrivilege	4552	powershell.exe
Token: SeTakeOwnershipPrivilege	4552	powershell.exe
Token: SeLoadDriverPrivilege	4552	powershell.exe
Token: SeSystemProfilePrivilege	4552	powershell.exe
Token: SeSystemtimePrivilege	4552	powershell.exe
Token: SeProfSingleProcessPrivilege	4552	powershell.exe
Token: SeIncBasePriorityPrivilege	4552	powershell.exe
Token: SeCreatePagefilePrivilege	4552	powershell.exe
Token: SeBackupPrivilege	4552	powershell.exe
Token: SeRestorePrivilege	4552	powershell.exe
Token: SeShutdownPrivilege	4552	powershell.exe
Token: SeDebugPrivilege	4552	powershell.exe
Token: SeSystemEnvironmentPrivilege	4552	powershell.exe
Token: SeRemoteShutdownPrivilege	4552	powershell.exe
Token: SeUndockPrivilege	4552	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3412	pcnetwork.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2316	2224	windows.exe	72
PID 2224 wrote to memory of 2316	2224	windows.exe	72
PID 2224 wrote to memory of 3672	2224	windows.exe	75
PID 2224 wrote to memory of 3672	2224	windows.exe	75
PID 2224 wrote to memory of 4280	2224	windows.exe	78
PID 2224 wrote to memory of 4280	2224	windows.exe	78
PID 4280 wrote to memory of 1212	4280	cmd.exe	80
PID 4280 wrote to memory of 1212	4280	cmd.exe	80
PID 3412 wrote to memory of 4552	3412	pcnetwork.exe	81
PID 3412 wrote to memory of 4552	3412	pcnetwork.exe	81
PID 3412 wrote to memory of 200	3412	pcnetwork.exe	83
PID 3412 wrote to memory of 200	3412	pcnetwork.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\windows.exe
"C:\Users\Admin\AppData\Local\Temp\windows.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\pcnetwork.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'pcnetwork.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpBCC8.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4280
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1212

C:\Windows\pcnetwork.exe
C:\Windows\pcnetwork.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\pcnetwork.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'pcnetwork.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
784a04c715dda274733e7d5cab120b61

SHA1
d488b3bf4a48582f42c0f66ce6b440aa296c074f

SHA256
8f1e40cdcab8f85fa6913c18e5c5a82989e7362295e9e1e9a6e36d6a6e3813a4

SHA512
87ab534b6f6eed6be70e0662af4c356d15cd093159d8dc47902943e7948babcfd6aa6ab33f633add10d3c02fec06f0bf87b121b8c21f718c7b0c0515d659418c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
df053439387af50e66dcdd463e970998

SHA1
3fc960e63d686f6d8a5a748fa56dde7cd62e2f77

SHA256
e36c3fef7d401215df39cb4e1dcf3c9bd6ecd276765b4a44d9f6dbcf918cb068

SHA512
06b4b96403ac3a475040c842189614414aa9bb53c79438fd0ff5e8c5486164d80819a1645d92efd699436587924e0222abed2c56ac076de3b90884f0dc9ac50a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d96d1ce94dc49f19405ffc1c478fde75

SHA1
59ae0471500d7672e764b15de7376207ceebd63d

SHA256
46832e71e7ff500deac3af836a07219a02c90906dd0c89685853eb61ab23c849

SHA512
cca1b4d7b5d8670334d89162cdf06e3015ce9869f302a4f2a130a1ea4c5794a59a954f36219507ce7d4ea3d2bac04e954a57e73ee24798825230195dc835551e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cgzkzvcy.kyt.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBCC8.tmp.bat

Filesize
159B

MD5
6a6e00ca9a39887964506ab82105c243

SHA1
6d4468cdd0ed6a6a009fad59a4304281d70ddafc

SHA256
ce2654ccef4933118074c9191cf9b174311610185f8e266077b0bebf8d5e188d

SHA512
70f102555b18a9b84c50e48c188325905f79dfeebbe859ee6f6cc0f27fdfd2fde7eb914c646868535405d8b1c30a8277a8511173b9c5a8aaf73e740879ec2ff1

Download Submit
C:\Windows\pcnetwork.exe

Filesize
332KB

MD5
21b941b814ff8935b0f5b308a8c7ec9c

SHA1
568e4c957b15f002eebb0bb291537e4c36c8f390

SHA256
986f5d92d64819c88ae6b48f2151cc780eb0aabe7d88bd488061f5efc48588fb

SHA512
dc486028a9d29f8e37454b38928222a932134ab2534b8bdf191ddd7e85da4edf39802e21de1af6de061b20a162ac14440d43320f8837f927e8e9ea354567ed18

Download Submit
memory/200-213-0x0000024DDFA60000-0x0000024DDFA70000-memory.dmp

Filesize
64KB

Download
memory/200-170-0x00007FF85B5C0000-0x00007FF85BFAC000-memory.dmp

Filesize
9.9MB

Download
memory/200-171-0x0000024DDFA60000-0x0000024DDFA70000-memory.dmp

Filesize
64KB

Download
memory/200-173-0x0000024DDFA60000-0x0000024DDFA70000-memory.dmp

Filesize
64KB

Download
memory/200-205-0x0000024DDFA60000-0x0000024DDFA70000-memory.dmp

Filesize
64KB

Download
memory/200-216-0x00007FF85B5C0000-0x00007FF85BFAC000-memory.dmp

Filesize
9.9MB

Download
memory/2224-1-0x00007FF85B5C0000-0x00007FF85BFAC000-memory.dmp

Filesize
9.9MB

Download
memory/2224-101-0x00007FF85B5C0000-0x00007FF85BFAC000-memory.dmp

Filesize
9.9MB

Download
memory/2224-106-0x000000001AEE0000-0x000000001AEF0000-memory.dmp

Filesize
64KB

Download
memory/2224-0-0x0000000000280000-0x00000000002D8000-memory.dmp

Filesize
352KB

Download
memory/2224-113-0x00007FF85B5C0000-0x00007FF85BFAC000-memory.dmp

Filesize
9.9MB

Download
memory/2316-8-0x00000249FB040000-0x00000249FB050000-memory.dmp

Filesize
64KB

Download
memory/2316-7-0x00000249FB040000-0x00000249FB050000-memory.dmp

Filesize
64KB

Download
memory/2316-5-0x00007FF85B5C0000-0x00007FF85BFAC000-memory.dmp

Filesize
9.9MB

Download
memory/2316-52-0x00007FF85B5C0000-0x00007FF85BFAC000-memory.dmp

Filesize
9.9MB

Download
memory/2316-48-0x00000249FB040000-0x00000249FB050000-memory.dmp

Filesize
64KB

Download
memory/2316-25-0x00000249FB040000-0x00000249FB050000-memory.dmp

Filesize
64KB

Download
memory/2316-12-0x00000249FB250000-0x00000249FB2C6000-memory.dmp

Filesize
472KB

Download
memory/2316-9-0x00000249E2BF0000-0x00000249E2C12000-memory.dmp

Filesize
136KB

Download
memory/3412-114-0x00007FF85B5C0000-0x00007FF85BFAC000-memory.dmp

Filesize
9.9MB

Download
memory/3412-115-0x0000000001390000-0x00000000013A0000-memory.dmp

Filesize
64KB

Download
memory/3412-116-0x0000000001360000-0x0000000001378000-memory.dmp

Filesize
96KB

Download
memory/3412-217-0x0000000001390000-0x00000000013A0000-memory.dmp

Filesize
64KB

Download
memory/3412-212-0x00007FF85B5C0000-0x00007FF85BFAC000-memory.dmp

Filesize
9.9MB

Download
memory/3672-60-0x0000014AA62C0000-0x0000014AA62D0000-memory.dmp

Filesize
64KB

Download
memory/3672-169-0x0000014AA62C0000-0x0000014AA62D0000-memory.dmp

Filesize
64KB

Download
memory/3672-103-0x00007FF85B5C0000-0x00007FF85BFAC000-memory.dmp

Filesize
9.9MB

Download
memory/3672-102-0x0000014AA62C0000-0x0000014AA62D0000-memory.dmp

Filesize
64KB

Download
memory/3672-76-0x0000014AA62C0000-0x0000014AA62D0000-memory.dmp

Filesize
64KB

Download
memory/3672-58-0x00007FF85B5C0000-0x00007FF85BFAC000-memory.dmp

Filesize
9.9MB

Download
memory/3672-59-0x0000014AA62C0000-0x0000014AA62D0000-memory.dmp

Filesize
64KB

Download
memory/4552-162-0x000002697EF10000-0x000002697EF20000-memory.dmp

Filesize
64KB

Download
memory/4552-165-0x00007FF85B5C0000-0x00007FF85BFAC000-memory.dmp

Filesize
9.9MB

Download
memory/4552-139-0x000002697EF10000-0x000002697EF20000-memory.dmp

Filesize
64KB

Download
memory/4552-120-0x00007FF85B5C0000-0x00007FF85BFAC000-memory.dmp

Filesize
9.9MB

Download
memory/4552-126-0x000002697EF10000-0x000002697EF20000-memory.dmp

Filesize
64KB

Download
memory/4552-125-0x000002697EF10000-0x000002697EF20000-memory.dmp

Filesize
64KB

Download