xworm | e7bde63f01511d2f90a5432c2f3194e172c100e23013708e3ac1e237839eccdb

Analysis

max time kernel
121s
max time network
156s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 02:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e7bde63f01511d2f90a5432c2f3194e172c100e23013708e3ac1e237839eccdb.exe
Size

35KB
MD5

15e0404ddfec1ec648ed0e0a6c588ad4
SHA1

548650029addcd3c91aaf238daf5e38d1eee6516
SHA256

e7bde63f01511d2f90a5432c2f3194e172c100e23013708e3ac1e237839eccdb
SHA512

90ed5756e0930a9c3fa6f37256371b7b8f8fe41225d2cddb10c51233d52a9f3b06517ad980a6f678d724e7c00e711c1b9f4885b59b865b8a53a894bd0e18929c
SSDEEP

384:tvg9j00WbqxAMTayV5N+5maFZZL3C8pJm3/KNm0ns0VgtFMAmNLToZw/RZCvK9In:mB4QBTOl3Cx3CNUVFQ92nsOMhSuvlS

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

3.1

marxrwo9090.duckdns.org:9090

Mutex

gEEZ3P8N2reeuJje

Attributes

Install_directory
%AppData%
install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2480-0-0x0000000000980000-0x0000000000990000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral1/memory/2480-0-0x0000000000980000-0x0000000000990000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e7bde63f01511d2f90a5432c2f3194e172c100e23013708e3ac1e237839eccdb.lnk	e7bde63f01511d2f90a5432c2f3194e172c100e23013708e3ac1e237839eccdb.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e7bde63f01511d2f90a5432c2f3194e172c100e23013708e3ac1e237839eccdb.lnk	e7bde63f01511d2f90a5432c2f3194e172c100e23013708e3ac1e237839eccdb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2480	e7bde63f01511d2f90a5432c2f3194e172c100e23013708e3ac1e237839eccdb.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2480	e7bde63f01511d2f90a5432c2f3194e172c100e23013708e3ac1e237839eccdb.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2480	e7bde63f01511d2f90a5432c2f3194e172c100e23013708e3ac1e237839eccdb.exe

C:\Users\Admin\AppData\Local\Temp\e7bde63f01511d2f90a5432c2f3194e172c100e23013708e3ac1e237839eccdb.exe
"C:\Users\Admin\AppData\Local\Temp\e7bde63f01511d2f90a5432c2f3194e172c100e23013708e3ac1e237839eccdb.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2480-0-0x0000000000980000-0x0000000000990000-memory.dmp

Filesize
64KB

Download
memory/2480-1-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

Filesize
9.9MB

Download
memory/2480-2-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

Filesize
9.9MB

Download
memory/2480-7-0x000000001ACA0000-0x000000001AD20000-memory.dmp

Filesize
512KB

Download
memory/2480-8-0x000000001ACA0000-0x000000001AD20000-memory.dmp

Filesize
512KB

Download