xworm | 986f5d92d64819c88ae6b48f2151cc780eb0aabe7d88bd488061f5efc48588fb

Resubmissions

08-02-2024 03:17

240208-ds6mzsdhcp 10

08-02-2024 03:05

240208-dlmxascc26 10

Analysis

max time kernel
146s
max time network
152s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
08-02-2024 03:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

windows.exe
Size

332KB
MD5

21b941b814ff8935b0f5b308a8c7ec9c
SHA1

568e4c957b15f002eebb0bb291537e4c36c8f390
SHA256

986f5d92d64819c88ae6b48f2151cc780eb0aabe7d88bd488061f5efc48588fb
SHA512

dc486028a9d29f8e37454b38928222a932134ab2534b8bdf191ddd7e85da4edf39802e21de1af6de061b20a162ac14440d43320f8837f927e8e9ea354567ed18
SSDEEP

6144:rd4bYBotL3mIhs8DyFPd4U1mGvEMdn7Ml/wCmCJ:rd4EBCqL4RpMi9XmCJ

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

hai1723rat-60039.portmap.io:60039

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource yara_rule

behavioral3/memory/3816-113-0x0000000000F90000-0x0000000000FA8000-memory.dmp family_xworm
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Executes dropped EXE 1 IoCs

Processes:

pcnetwork.exe

pid process

3816 pcnetwork.exe
Drops file in Windows directory 2 IoCs

Processes:

windows.exe

description ioc process

File created C:\Windows\pcnetwork.exe windows.exe
File opened for modification C:\Windows\pcnetwork.exe windows.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1752 timeout.exe

resource	yara_rule
behavioral3/memory/3816-113-0x0000000000F90000-0x0000000000FA8000-memory.dmp	family_xworm

pid	process
3816	pcnetwork.exe

description	ioc	process
File created	C:\Windows\pcnetwork.exe	windows.exe
File opened for modification	C:\Windows\pcnetwork.exe	windows.exe

pid	process
1752	timeout.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepcnetwork.exe

pid	process
1460	powershell.exe
1460	powershell.exe
1460	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
1108	powershell.exe
1108	powershell.exe
1108	powershell.exe
3816	pcnetwork.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

windows.exepowershell.exepowershell.exepcnetwork.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	3516	windows.exe
Token: SeDebugPrivilege	1460	powershell.exe
Token: SeIncreaseQuotaPrivilege	1460	powershell.exe
Token: SeSecurityPrivilege	1460	powershell.exe
Token: SeTakeOwnershipPrivilege	1460	powershell.exe
Token: SeLoadDriverPrivilege	1460	powershell.exe
Token: SeSystemProfilePrivilege	1460	powershell.exe
Token: SeSystemtimePrivilege	1460	powershell.exe
Token: SeProfSingleProcessPrivilege	1460	powershell.exe
Token: SeIncBasePriorityPrivilege	1460	powershell.exe
Token: SeCreatePagefilePrivilege	1460	powershell.exe
Token: SeBackupPrivilege	1460	powershell.exe
Token: SeRestorePrivilege	1460	powershell.exe
Token: SeShutdownPrivilege	1460	powershell.exe
Token: SeDebugPrivilege	1460	powershell.exe
Token: SeSystemEnvironmentPrivilege	1460	powershell.exe
Token: SeRemoteShutdownPrivilege	1460	powershell.exe
Token: SeUndockPrivilege	1460	powershell.exe
Token: SeManageVolumePrivilege	1460	powershell.exe
Token: 33	1460	powershell.exe
Token: 34	1460	powershell.exe
Token: 35	1460	powershell.exe
Token: 36	1460	powershell.exe
Token: SeDebugPrivilege	1236	powershell.exe
Token: SeIncreaseQuotaPrivilege	1236	powershell.exe
Token: SeSecurityPrivilege	1236	powershell.exe
Token: SeTakeOwnershipPrivilege	1236	powershell.exe
Token: SeLoadDriverPrivilege	1236	powershell.exe
Token: SeSystemProfilePrivilege	1236	powershell.exe
Token: SeSystemtimePrivilege	1236	powershell.exe
Token: SeProfSingleProcessPrivilege	1236	powershell.exe
Token: SeIncBasePriorityPrivilege	1236	powershell.exe
Token: SeCreatePagefilePrivilege	1236	powershell.exe
Token: SeBackupPrivilege	1236	powershell.exe
Token: SeRestorePrivilege	1236	powershell.exe
Token: SeShutdownPrivilege	1236	powershell.exe
Token: SeDebugPrivilege	1236	powershell.exe
Token: SeSystemEnvironmentPrivilege	1236	powershell.exe
Token: SeRemoteShutdownPrivilege	1236	powershell.exe
Token: SeUndockPrivilege	1236	powershell.exe
Token: SeManageVolumePrivilege	1236	powershell.exe
Token: 33	1236	powershell.exe
Token: 34	1236	powershell.exe
Token: 35	1236	powershell.exe
Token: 36	1236	powershell.exe
Token: SeDebugPrivilege	3816	pcnetwork.exe
Token: SeDebugPrivilege	3816	pcnetwork.exe
Token: SeDebugPrivilege	1628	powershell.exe
Token: SeIncreaseQuotaPrivilege	1628	powershell.exe
Token: SeSecurityPrivilege	1628	powershell.exe
Token: SeTakeOwnershipPrivilege	1628	powershell.exe
Token: SeLoadDriverPrivilege	1628	powershell.exe
Token: SeSystemProfilePrivilege	1628	powershell.exe
Token: SeSystemtimePrivilege	1628	powershell.exe
Token: SeProfSingleProcessPrivilege	1628	powershell.exe
Token: SeIncBasePriorityPrivilege	1628	powershell.exe
Token: SeCreatePagefilePrivilege	1628	powershell.exe
Token: SeBackupPrivilege	1628	powershell.exe
Token: SeRestorePrivilege	1628	powershell.exe
Token: SeShutdownPrivilege	1628	powershell.exe
Token: SeDebugPrivilege	1628	powershell.exe
Token: SeSystemEnvironmentPrivilege	1628	powershell.exe
Token: SeRemoteShutdownPrivilege	1628	powershell.exe
Token: SeUndockPrivilege	1628	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

pcnetwork.exe

pid process

3816 pcnetwork.exe

pid	process
3816	pcnetwork.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

windows.execmd.exepcnetwork.exe

description	pid	process	target process
PID 3516 wrote to memory of 1460	3516	windows.exe	powershell.exe
PID 3516 wrote to memory of 1460	3516	windows.exe	powershell.exe
PID 3516 wrote to memory of 1236	3516	windows.exe	powershell.exe
PID 3516 wrote to memory of 1236	3516	windows.exe	powershell.exe
PID 3516 wrote to memory of 1336	3516	windows.exe	cmd.exe
PID 3516 wrote to memory of 1336	3516	windows.exe	cmd.exe
PID 1336 wrote to memory of 1752	1336	cmd.exe	timeout.exe
PID 1336 wrote to memory of 1752	1336	cmd.exe	timeout.exe
PID 3816 wrote to memory of 1628	3816	pcnetwork.exe	powershell.exe
PID 3816 wrote to memory of 1628	3816	pcnetwork.exe	powershell.exe
PID 3816 wrote to memory of 1108	3816	pcnetwork.exe	powershell.exe
PID 3816 wrote to memory of 1108	3816	pcnetwork.exe	powershell.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\windows.exe
"C:\Users\Admin\AppData\Local\Temp\windows.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3516

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\pcnetwork.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1460

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'pcnetwork.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp87ED.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:1336

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:1752

C:\Windows\pcnetwork.exe
C:\Windows\pcnetwork.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3816

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\pcnetwork.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1628

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'pcnetwork.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1108

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
cbb99df7c06cb4ee33efb23ab2d9632c

SHA1
bbe1bdc5831fb9fe11bd257048baa97460ab08b1

SHA256
4a0351a64554b2a82e74185047ebe8e96341945b916828151932f8c5fd4cccdb

SHA512
9e5e63491b0fdbffaee10b5edbd085c2ac704bb4daa27861a877cbe39115b01e07f7d3c669f6fe251e4f0e7126a6ef7bf6ef0741974e9659e04c94cedf7382bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
e6c2b5d6f2500ba83ec051d267e95e83

SHA1
709113bb5fe75d419f59ac7096ec5659d6d74b69

SHA256
59cb55fbd68d9794f9fe55eae508be0479a7c365eff3cb8615acd73cf25f7bd2

SHA512
25b1c6d45931468dfe9ad8f38968271abf11ee4aecd51b5b709874d1fab622385ce71445b0150037147800ef1abe49fd8ac65318abd6d82bc2ab35b01bf1624d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
80a70e00ded60ba3aa405515bb9ac122

SHA1
8ead0496111b822b275813256e74fda7d6658dcb

SHA256
c6748e30fabb8604b371964f7f013d3abd2e97a1815071299a6b0842d397dba9

SHA512
b18a371553055e4c7a10dacf2868701b5270df0d0e79d08ef16bda1b30e77b8d413e258daa0d881fcc3b6abc2111066ae319b6013608cb530278d9c7d8102e77

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_biel5lpm.s0f.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp87ED.tmp.bat
Filesize
159B

MD5
19a81520c9ba182d289c3555c1b51508

SHA1
6277dbd24335e39bdc8412498cad98f92bb44ae9

SHA256
e571e83e8f2cd43dca47a08f20c95fe057d12c6dfe4753525b024f07c3e1c7a0

SHA512
10b2f0b03a2997c8adcc676a2e32e76fd07c38312694cf4251a15a55de32b67808a03a9fea13603fae8b0b2de0ae197a332f6146006d8c29a67fe5b6ba047b93

Download Submit
C:\Windows\pcnetwork.exe
Filesize
332KB

MD5
21b941b814ff8935b0f5b308a8c7ec9c

SHA1
568e4c957b15f002eebb0bb291537e4c36c8f390

SHA256
986f5d92d64819c88ae6b48f2151cc780eb0aabe7d88bd488061f5efc48588fb

SHA512
dc486028a9d29f8e37454b38928222a932134ab2534b8bdf191ddd7e85da4edf39802e21de1af6de061b20a162ac14440d43320f8837f927e8e9ea354567ed18

Download Submit
memory/1108-173-0x0000024982010000-0x0000024982020000-memory.dmp

Filesize
64KB

Download
memory/1108-171-0x00007FFDF4850000-0x00007FFDF523C000-memory.dmp

Filesize
9.9MB

Download
memory/1108-172-0x0000024982010000-0x0000024982020000-memory.dmp

Filesize
64KB

Download
memory/1108-188-0x0000024982010000-0x0000024982020000-memory.dmp

Filesize
64KB

Download
memory/1108-211-0x0000024982010000-0x0000024982020000-memory.dmp

Filesize
64KB

Download
memory/1108-214-0x00007FFDF4850000-0x00007FFDF523C000-memory.dmp

Filesize
9.9MB

Download
memory/1236-59-0x0000025D7ECD0000-0x0000025D7ECE0000-memory.dmp

Filesize
64KB

Download
memory/1236-60-0x0000025D7ECD0000-0x0000025D7ECE0000-memory.dmp

Filesize
64KB

Download
memory/1236-57-0x00007FFDF4850000-0x00007FFDF523C000-memory.dmp

Filesize
9.9MB

Download
memory/1236-75-0x0000025D7ECD0000-0x0000025D7ECE0000-memory.dmp

Filesize
64KB

Download
memory/1236-97-0x0000025D7ECD0000-0x0000025D7ECE0000-memory.dmp

Filesize
64KB

Download
memory/1236-101-0x00007FFDF4850000-0x00007FFDF523C000-memory.dmp

Filesize
9.9MB

Download
memory/1460-51-0x00007FFDF4850000-0x00007FFDF523C000-memory.dmp

Filesize
9.9MB

Download
memory/1460-12-0x0000029BAE280000-0x0000029BAE2F6000-memory.dmp

Filesize
472KB

Download
memory/1460-6-0x00007FFDF4850000-0x00007FFDF523C000-memory.dmp

Filesize
9.9MB

Download
memory/1460-8-0x0000029BADD50000-0x0000029BADD60000-memory.dmp

Filesize
64KB

Download
memory/1460-7-0x0000029BADD60000-0x0000029BADD82000-memory.dmp

Filesize
136KB

Download
memory/1460-9-0x0000029BADD50000-0x0000029BADD60000-memory.dmp

Filesize
64KB

Download
memory/1460-25-0x0000029BADD50000-0x0000029BADD60000-memory.dmp

Filesize
64KB

Download
memory/1460-48-0x0000029BADD50000-0x0000029BADD60000-memory.dmp

Filesize
64KB

Download
memory/1628-120-0x0000023DFB660000-0x0000023DFB670000-memory.dmp

Filesize
64KB

Download
memory/1628-122-0x0000023DFB660000-0x0000023DFB670000-memory.dmp

Filesize
64KB

Download
memory/1628-119-0x00007FFDF4850000-0x00007FFDF523C000-memory.dmp

Filesize
9.9MB

Download
memory/1628-138-0x0000023DFB660000-0x0000023DFB670000-memory.dmp

Filesize
64KB

Download
memory/1628-161-0x0000023DFB660000-0x0000023DFB670000-memory.dmp

Filesize
64KB

Download
memory/1628-164-0x00007FFDF4850000-0x00007FFDF523C000-memory.dmp

Filesize
9.9MB

Download
memory/3516-0-0x0000000000190000-0x00000000001E8000-memory.dmp

Filesize
352KB

Download
memory/3516-1-0x00007FFDF4850000-0x00007FFDF523C000-memory.dmp

Filesize
9.9MB

Download
memory/3516-105-0x000000001AE80000-0x000000001AE90000-memory.dmp

Filesize
64KB

Download
memory/3516-104-0x00007FFDF4850000-0x00007FFDF523C000-memory.dmp

Filesize
9.9MB

Download
memory/3516-112-0x00007FFDF4850000-0x00007FFDF523C000-memory.dmp

Filesize
9.9MB

Download
memory/3816-115-0x000000001B440000-0x000000001B450000-memory.dmp

Filesize
64KB

Download
memory/3816-187-0x00007FFDF4850000-0x00007FFDF523C000-memory.dmp

Filesize
9.9MB

Download
memory/3816-113-0x0000000000F90000-0x0000000000FA8000-memory.dmp

Filesize
96KB

Download
memory/3816-114-0x00007FFDF4850000-0x00007FFDF523C000-memory.dmp

Filesize
9.9MB

Download