xworm | da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d

Analysis

max time kernel
147s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-02-2024 17:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe
Size

536KB
MD5

9e4189753ba9f1bc23b3fc46929451df
SHA1

51e3fc1c0552a4dd0dd9bad83d2b8a03864bdda6
SHA256

da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d
SHA512

ffb9689723f471eeb59197014f690171584e147b3b5d8580c2aa99716f3275444c283303effc31119c9654ada1e78d7c889aa588aedee62fb1db5df07e17a0d8
SSDEEP

12288:VvjpkDaBs/iYvHB/Wv6AuYXpJM9cL+FlQstOWI2r0VYZyzN:dFTaqOHdSuNY+FWEJ+4UN

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

104.250.180.178:7061

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

Detect Xworm Payload 5 IoCs

resource	yara_rule
behavioral1/memory/2632-9-0x0000000000400000-0x0000000000414000-memory.dmp	family_xworm
behavioral1/memory/2632-10-0x0000000000400000-0x0000000000414000-memory.dmp	family_xworm
behavioral1/memory/2632-13-0x0000000000400000-0x0000000000414000-memory.dmp	family_xworm
behavioral1/memory/2632-17-0x0000000000400000-0x0000000000414000-memory.dmp	family_xworm
behavioral1/memory/2632-15-0x0000000000400000-0x0000000000414000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detects Windows executables referencing non-Windows User-Agents 5 IoCs

resource	yara_rule
behavioral1/memory/2632-9-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2632-10-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2632-13-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2632-17-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2632-15-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe

Loads dropped DLL 1 IoCs

pid	Process
2632	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2256 set thread context of 2632	2256	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2256	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe
2256	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe
2676	powershell.exe
2440	powershell.exe
2380	powershell.exe
1548	powershell.exe
2632	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2256	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe
Token: SeDebugPrivilege	2632	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe
Token: SeDebugPrivilege	2676	powershell.exe
Token: SeDebugPrivilege	2440	powershell.exe
Token: SeDebugPrivilege	2380	powershell.exe
Token: SeDebugPrivilege	1548	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2632	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2632	2256	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe	28
PID 2256 wrote to memory of 2632	2256	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe	28
PID 2256 wrote to memory of 2632	2256	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe	28
PID 2256 wrote to memory of 2632	2256	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe	28
PID 2256 wrote to memory of 2632	2256	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe	28
PID 2256 wrote to memory of 2632	2256	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe	28
PID 2256 wrote to memory of 2632	2256	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe	28
PID 2256 wrote to memory of 2632	2256	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe	28
PID 2256 wrote to memory of 2632	2256	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe	28
PID 2632 wrote to memory of 2676	2632	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe	29
PID 2632 wrote to memory of 2676	2632	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe	29
PID 2632 wrote to memory of 2676	2632	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe	29
PID 2632 wrote to memory of 2676	2632	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe	29
PID 2632 wrote to memory of 2440	2632	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe	31
PID 2632 wrote to memory of 2440	2632	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe	31
PID 2632 wrote to memory of 2440	2632	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe	31
PID 2632 wrote to memory of 2440	2632	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe	31
PID 2632 wrote to memory of 2380	2632	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe	33
PID 2632 wrote to memory of 2380	2632	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe	33
PID 2632 wrote to memory of 2380	2632	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe	33
PID 2632 wrote to memory of 2380	2632	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe	33
PID 2632 wrote to memory of 1548	2632	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe	35
PID 2632 wrote to memory of 1548	2632	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe	35
PID 2632 wrote to memory of 1548	2632	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe	35
PID 2632 wrote to memory of 1548	2632	da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe	35

C:\Users\Admin\AppData\Local\Temp\da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe
"C:\Users\Admin\AppData\Local\Temp\da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\Temp\da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe
  "C:\Users\Admin\AppData\Local\Temp\da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2676
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2440
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2380
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
1bd2c19ffff3b940bcd61134851c60b2

SHA1
3b8b6edb3a9aadcda1709720d618f223040ca504

SHA256
1d5f8ae953298a1196ad0983f6eccca4f45f1875018e306833ae2e759e8d7556

SHA512
e1a149d76e1bba0f8b38ede8af2a6d9ad9065a495ef6815da70e66f2e9b20f51e436b2b3b40fae827bc6e350922123021fb2b8a85ba9d78de717c79a385c2687

Download Submit
\Users\Admin\AppData\Roaming\XClient.exe

Filesize
536KB

MD5
9e4189753ba9f1bc23b3fc46929451df

SHA1
51e3fc1c0552a4dd0dd9bad83d2b8a03864bdda6

SHA256
da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d

SHA512
ffb9689723f471eeb59197014f690171584e147b3b5d8580c2aa99716f3275444c283303effc31119c9654ada1e78d7c889aa588aedee62fb1db5df07e17a0d8

Download Submit
memory/1548-54-0x000000006FEF0000-0x000000007049B000-memory.dmp

Filesize
5.7MB

Download
memory/1548-49-0x000000006FEF0000-0x000000007049B000-memory.dmp

Filesize
5.7MB

Download
memory/1548-50-0x0000000002B80000-0x0000000002BC0000-memory.dmp

Filesize
256KB

Download
memory/1548-51-0x000000006FEF0000-0x000000007049B000-memory.dmp

Filesize
5.7MB

Download
memory/1548-52-0x000000006FEF0000-0x000000007049B000-memory.dmp

Filesize
5.7MB

Download
memory/1548-53-0x0000000002B80000-0x0000000002BC0000-memory.dmp

Filesize
256KB

Download
memory/2256-5-0x0000000000350000-0x0000000000362000-memory.dmp

Filesize
72KB

Download
memory/2256-2-0x0000000000F90000-0x0000000000FD0000-memory.dmp

Filesize
256KB

Download
memory/2256-0-0x0000000001350000-0x00000000013DC000-memory.dmp

Filesize
560KB

Download
memory/2256-1-0x0000000074DE0000-0x00000000754CE000-memory.dmp

Filesize
6.9MB

Download
memory/2256-4-0x00000000002A0000-0x00000000002AC000-memory.dmp

Filesize
48KB

Download
memory/2256-18-0x0000000074DE0000-0x00000000754CE000-memory.dmp

Filesize
6.9MB

Download
memory/2256-3-0x0000000000320000-0x0000000000342000-memory.dmp

Filesize
136KB

Download
memory/2256-6-0x00000000012D0000-0x0000000001326000-memory.dmp

Filesize
344KB

Download
memory/2380-43-0x0000000071470000-0x0000000071A1B000-memory.dmp

Filesize
5.7MB

Download
memory/2380-42-0x0000000071470000-0x0000000071A1B000-memory.dmp

Filesize
5.7MB

Download
memory/2380-41-0x0000000002B20000-0x0000000002B60000-memory.dmp

Filesize
256KB

Download
memory/2380-40-0x0000000071470000-0x0000000071A1B000-memory.dmp

Filesize
5.7MB

Download
memory/2440-34-0x000000006FEF0000-0x000000007049B000-memory.dmp

Filesize
5.7MB

Download
memory/2440-33-0x000000006FEF0000-0x000000007049B000-memory.dmp

Filesize
5.7MB

Download
memory/2440-32-0x000000006FEF0000-0x000000007049B000-memory.dmp

Filesize
5.7MB

Download
memory/2632-10-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2632-7-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2632-62-0x00000000048E0000-0x0000000004920000-memory.dmp

Filesize
256KB

Download
memory/2632-61-0x0000000074DE0000-0x00000000754CE000-memory.dmp

Filesize
6.9MB

Download
memory/2632-60-0x00000000048E0000-0x0000000004920000-memory.dmp

Filesize
256KB

Download
memory/2632-8-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2632-19-0x0000000074DE0000-0x00000000754CE000-memory.dmp

Filesize
6.9MB

Download
memory/2632-15-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2632-17-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2632-13-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2632-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2632-9-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2676-22-0x0000000071470000-0x0000000071A1B000-memory.dmp

Filesize
5.7MB

Download
memory/2676-26-0x0000000071470000-0x0000000071A1B000-memory.dmp

Filesize
5.7MB

Download
memory/2676-23-0x0000000002980000-0x00000000029C0000-memory.dmp

Filesize
256KB

Download
memory/2676-24-0x0000000002980000-0x00000000029C0000-memory.dmp

Filesize
256KB

Download
memory/2676-25-0x0000000071470000-0x0000000071A1B000-memory.dmp

Filesize
5.7MB

Download