xworm | 986f5d92d64819c88ae6b48f2151cc780eb0aabe7d88bd488061f5efc48588fb

General

Target

windows.exe
Size

332KB
MD5

21b941b814ff8935b0f5b308a8c7ec9c
SHA1

568e4c957b15f002eebb0bb291537e4c36c8f390
SHA256

986f5d92d64819c88ae6b48f2151cc780eb0aabe7d88bd488061f5efc48588fb
SHA512

dc486028a9d29f8e37454b38928222a932134ab2534b8bdf191ddd7e85da4edf39802e21de1af6de061b20a162ac14440d43320f8837f927e8e9ea354567ed18
SSDEEP

6144:rd4bYBotL3mIhs8DyFPd4U1mGvEMdn7Ml/wCmCJ:rd4EBCqL4RpMi9XmCJ

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

C2

hai1723rat-60039.portmap.io:60039

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3412-116-0x0000000001360000-0x0000000001378000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Executes dropped EXE 1 IoCs

Processes:

pcnetwork.exe

pid process

3412 pcnetwork.exe
Drops file in Windows directory 2 IoCs

Processes:

windows.exe

description ioc process

File created C:\Windows\pcnetwork.exe windows.exe
File opened for modification C:\Windows\pcnetwork.exe windows.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1212 timeout.exe

pid	process
3412	pcnetwork.exe

description	ioc	process
File created	C:\Windows\pcnetwork.exe	windows.exe
File opened for modification	C:\Windows\pcnetwork.exe	windows.exe

pid	process
1212	timeout.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepcnetwork.exe

pid	process
2316	powershell.exe
2316	powershell.exe
2316	powershell.exe
3672	powershell.exe
3672	powershell.exe
3672	powershell.exe
4552	powershell.exe
4552	powershell.exe
4552	powershell.exe
200	powershell.exe
200	powershell.exe
200	powershell.exe
3412	pcnetwork.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

windows.exepowershell.exepowershell.exepcnetwork.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2224	windows.exe
Token: SeDebugPrivilege	2316	powershell.exe
Token: SeIncreaseQuotaPrivilege	2316	powershell.exe
Token: SeSecurityPrivilege	2316	powershell.exe
Token: SeTakeOwnershipPrivilege	2316	powershell.exe
Token: SeLoadDriverPrivilege	2316	powershell.exe
Token: SeSystemProfilePrivilege	2316	powershell.exe
Token: SeSystemtimePrivilege	2316	powershell.exe
Token: SeProfSingleProcessPrivilege	2316	powershell.exe
Token: SeIncBasePriorityPrivilege	2316	powershell.exe
Token: SeCreatePagefilePrivilege	2316	powershell.exe
Token: SeBackupPrivilege	2316	powershell.exe
Token: SeRestorePrivilege	2316	powershell.exe
Token: SeShutdownPrivilege	2316	powershell.exe
Token: SeDebugPrivilege	2316	powershell.exe
Token: SeSystemEnvironmentPrivilege	2316	powershell.exe
Token: SeRemoteShutdownPrivilege	2316	powershell.exe
Token: SeUndockPrivilege	2316	powershell.exe
Token: SeManageVolumePrivilege	2316	powershell.exe
Token: 33	2316	powershell.exe
Token: 34	2316	powershell.exe
Token: 35	2316	powershell.exe
Token: 36	2316	powershell.exe
Token: SeDebugPrivilege	3672	powershell.exe
Token: SeIncreaseQuotaPrivilege	3672	powershell.exe
Token: SeSecurityPrivilege	3672	powershell.exe
Token: SeTakeOwnershipPrivilege	3672	powershell.exe
Token: SeLoadDriverPrivilege	3672	powershell.exe
Token: SeSystemProfilePrivilege	3672	powershell.exe
Token: SeSystemtimePrivilege	3672	powershell.exe
Token: SeProfSingleProcessPrivilege	3672	powershell.exe
Token: SeIncBasePriorityPrivilege	3672	powershell.exe
Token: SeCreatePagefilePrivilege	3672	powershell.exe
Token: SeBackupPrivilege	3672	powershell.exe
Token: SeRestorePrivilege	3672	powershell.exe
Token: SeShutdownPrivilege	3672	powershell.exe
Token: SeDebugPrivilege	3672	powershell.exe
Token: SeSystemEnvironmentPrivilege	3672	powershell.exe
Token: SeRemoteShutdownPrivilege	3672	powershell.exe
Token: SeUndockPrivilege	3672	powershell.exe
Token: SeManageVolumePrivilege	3672	powershell.exe
Token: 33	3672	powershell.exe
Token: 34	3672	powershell.exe
Token: 35	3672	powershell.exe
Token: 36	3672	powershell.exe
Token: SeDebugPrivilege	3412	pcnetwork.exe
Token: SeDebugPrivilege	3412	pcnetwork.exe
Token: SeDebugPrivilege	4552	powershell.exe
Token: SeIncreaseQuotaPrivilege	4552	powershell.exe
Token: SeSecurityPrivilege	4552	powershell.exe
Token: SeTakeOwnershipPrivilege	4552	powershell.exe
Token: SeLoadDriverPrivilege	4552	powershell.exe
Token: SeSystemProfilePrivilege	4552	powershell.exe
Token: SeSystemtimePrivilege	4552	powershell.exe
Token: SeProfSingleProcessPrivilege	4552	powershell.exe
Token: SeIncBasePriorityPrivilege	4552	powershell.exe
Token: SeCreatePagefilePrivilege	4552	powershell.exe
Token: SeBackupPrivilege	4552	powershell.exe
Token: SeRestorePrivilege	4552	powershell.exe
Token: SeShutdownPrivilege	4552	powershell.exe
Token: SeDebugPrivilege	4552	powershell.exe
Token: SeSystemEnvironmentPrivilege	4552	powershell.exe
Token: SeRemoteShutdownPrivilege	4552	powershell.exe
Token: SeUndockPrivilege	4552	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

pcnetwork.exe

pid process

3412 pcnetwork.exe

pid	process
3412	pcnetwork.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

windows.execmd.exepcnetwork.exe

description	pid	process	target process
PID 2224 wrote to memory of 2316	2224	windows.exe	powershell.exe
PID 2224 wrote to memory of 2316	2224	windows.exe	powershell.exe
PID 2224 wrote to memory of 3672	2224	windows.exe	powershell.exe
PID 2224 wrote to memory of 3672	2224	windows.exe	powershell.exe
PID 2224 wrote to memory of 4280	2224	windows.exe	cmd.exe
PID 2224 wrote to memory of 4280	2224	windows.exe	cmd.exe
PID 4280 wrote to memory of 1212	4280	cmd.exe	timeout.exe
PID 4280 wrote to memory of 1212	4280	cmd.exe	timeout.exe
PID 3412 wrote to memory of 4552	3412	pcnetwork.exe	powershell.exe
PID 3412 wrote to memory of 4552	3412	pcnetwork.exe	powershell.exe
PID 3412 wrote to memory of 200	3412	pcnetwork.exe	powershell.exe
PID 3412 wrote to memory of 200	3412	pcnetwork.exe	powershell.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\windows.exe
"C:\Users\Admin\AppData\Local\Temp\windows.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\pcnetwork.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2316

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'pcnetwork.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpBCC8.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:4280

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:1212

C:\Windows\pcnetwork.exe
C:\Windows\pcnetwork.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3412

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\pcnetwork.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'pcnetwork.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:200

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
784a04c715dda274733e7d5cab120b61

SHA1
d488b3bf4a48582f42c0f66ce6b440aa296c074f

SHA256
8f1e40cdcab8f85fa6913c18e5c5a82989e7362295e9e1e9a6e36d6a6e3813a4

SHA512
87ab534b6f6eed6be70e0662af4c356d15cd093159d8dc47902943e7948babcfd6aa6ab33f633add10d3c02fec06f0bf87b121b8c21f718c7b0c0515d659418c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
df053439387af50e66dcdd463e970998

SHA1
3fc960e63d686f6d8a5a748fa56dde7cd62e2f77

SHA256
e36c3fef7d401215df39cb4e1dcf3c9bd6ecd276765b4a44d9f6dbcf918cb068

SHA512
06b4b96403ac3a475040c842189614414aa9bb53c79438fd0ff5e8c5486164d80819a1645d92efd699436587924e0222abed2c56ac076de3b90884f0dc9ac50a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
d96d1ce94dc49f19405ffc1c478fde75

SHA1
59ae0471500d7672e764b15de7376207ceebd63d

SHA256
46832e71e7ff500deac3af836a07219a02c90906dd0c89685853eb61ab23c849

SHA512
cca1b4d7b5d8670334d89162cdf06e3015ce9869f302a4f2a130a1ea4c5794a59a954f36219507ce7d4ea3d2bac04e954a57e73ee24798825230195dc835551e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cgzkzvcy.kyt.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBCC8.tmp.bat
Filesize
159B

MD5
6a6e00ca9a39887964506ab82105c243

SHA1
6d4468cdd0ed6a6a009fad59a4304281d70ddafc

SHA256
ce2654ccef4933118074c9191cf9b174311610185f8e266077b0bebf8d5e188d

SHA512
70f102555b18a9b84c50e48c188325905f79dfeebbe859ee6f6cc0f27fdfd2fde7eb914c646868535405d8b1c30a8277a8511173b9c5a8aaf73e740879ec2ff1

Download Submit
C:\Windows\pcnetwork.exe
Filesize
332KB

MD5
21b941b814ff8935b0f5b308a8c7ec9c

SHA1
568e4c957b15f002eebb0bb291537e4c36c8f390

SHA256
986f5d92d64819c88ae6b48f2151cc780eb0aabe7d88bd488061f5efc48588fb

SHA512
dc486028a9d29f8e37454b38928222a932134ab2534b8bdf191ddd7e85da4edf39802e21de1af6de061b20a162ac14440d43320f8837f927e8e9ea354567ed18

Download Submit
memory/200-213-0x0000024DDFA60000-0x0000024DDFA70000-memory.dmp

Filesize
64KB

Download
memory/200-170-0x00007FF85B5C0000-0x00007FF85BFAC000-memory.dmp

Filesize
9.9MB

Download
memory/200-171-0x0000024DDFA60000-0x0000024DDFA70000-memory.dmp

Filesize
64KB

Download
memory/200-173-0x0000024DDFA60000-0x0000024DDFA70000-memory.dmp

Filesize
64KB

Download
memory/200-205-0x0000024DDFA60000-0x0000024DDFA70000-memory.dmp

Filesize
64KB

Download
memory/200-216-0x00007FF85B5C0000-0x00007FF85BFAC000-memory.dmp

Filesize
9.9MB

Download
memory/2224-1-0x00007FF85B5C0000-0x00007FF85BFAC000-memory.dmp

Filesize
9.9MB

Download
memory/2224-101-0x00007FF85B5C0000-0x00007FF85BFAC000-memory.dmp

Filesize
9.9MB

Download
memory/2224-106-0x000000001AEE0000-0x000000001AEF0000-memory.dmp

Filesize
64KB

Download
memory/2224-0-0x0000000000280000-0x00000000002D8000-memory.dmp

Filesize
352KB

Download
memory/2224-113-0x00007FF85B5C0000-0x00007FF85BFAC000-memory.dmp

Filesize
9.9MB

Download
memory/2316-8-0x00000249FB040000-0x00000249FB050000-memory.dmp

Filesize
64KB

Download
memory/2316-7-0x00000249FB040000-0x00000249FB050000-memory.dmp

Filesize
64KB

Download
memory/2316-5-0x00007FF85B5C0000-0x00007FF85BFAC000-memory.dmp

Filesize
9.9MB

Download
memory/2316-52-0x00007FF85B5C0000-0x00007FF85BFAC000-memory.dmp

Filesize
9.9MB

Download
memory/2316-48-0x00000249FB040000-0x00000249FB050000-memory.dmp

Filesize
64KB

Download
memory/2316-25-0x00000249FB040000-0x00000249FB050000-memory.dmp

Filesize
64KB

Download
memory/2316-12-0x00000249FB250000-0x00000249FB2C6000-memory.dmp

Filesize
472KB

Download
memory/2316-9-0x00000249E2BF0000-0x00000249E2C12000-memory.dmp

Filesize
136KB

Download
memory/3412-114-0x00007FF85B5C0000-0x00007FF85BFAC000-memory.dmp

Filesize
9.9MB

Download
memory/3412-115-0x0000000001390000-0x00000000013A0000-memory.dmp

Filesize
64KB

Download
memory/3412-116-0x0000000001360000-0x0000000001378000-memory.dmp

Filesize
96KB

Download
memory/3412-217-0x0000000001390000-0x00000000013A0000-memory.dmp

Filesize
64KB

Download
memory/3412-212-0x00007FF85B5C0000-0x00007FF85BFAC000-memory.dmp

Filesize
9.9MB

Download
memory/3672-60-0x0000014AA62C0000-0x0000014AA62D0000-memory.dmp

Filesize
64KB

Download
memory/3672-169-0x0000014AA62C0000-0x0000014AA62D0000-memory.dmp

Filesize
64KB

Download
memory/3672-103-0x00007FF85B5C0000-0x00007FF85BFAC000-memory.dmp

Filesize
9.9MB

Download
memory/3672-102-0x0000014AA62C0000-0x0000014AA62D0000-memory.dmp

Filesize
64KB

Download
memory/3672-76-0x0000014AA62C0000-0x0000014AA62D0000-memory.dmp

Filesize
64KB

Download
memory/3672-58-0x00007FF85B5C0000-0x00007FF85BFAC000-memory.dmp

Filesize
9.9MB

Download
memory/3672-59-0x0000014AA62C0000-0x0000014AA62D0000-memory.dmp

Filesize
64KB

Download
memory/4552-162-0x000002697EF10000-0x000002697EF20000-memory.dmp

Filesize
64KB

Download
memory/4552-165-0x00007FF85B5C0000-0x00007FF85BFAC000-memory.dmp

Filesize
9.9MB

Download
memory/4552-139-0x000002697EF10000-0x000002697EF20000-memory.dmp

Filesize
64KB

Download
memory/4552-120-0x00007FF85B5C0000-0x00007FF85BFAC000-memory.dmp

Filesize
9.9MB

Download
memory/4552-126-0x000002697EF10000-0x000002697EF20000-memory.dmp

Filesize
64KB

Download
memory/4552-125-0x000002697EF10000-0x000002697EF20000-memory.dmp

Filesize
64KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads