xworm | c78eb4a370c5a7ad6d1d0dc50a3a64d728cf3b080ace43d3c6e80f3a20823f0a

General

Target

Xworm5.4_rar.exe
Size

79KB
MD5

21b50d1deafc8a40e5dd767a91c67f83
SHA1

f598ccda048c05afc16b70dd16be3bd0f1326e8d
SHA256

c78eb4a370c5a7ad6d1d0dc50a3a64d728cf3b080ace43d3c6e80f3a20823f0a
SHA512

5db0ef98e6039b36e1216dbb20193e852146934dae01c2c4442a761fa1d31365c53f2f6fb950730a535975aa86d2c634e26900ee6b46ad4e182222c3a055ba85
SSDEEP

1536:3ogpYw43GKut7PFr1iAi65tbRRQJ4jt6ctUP0O/wYnK57476Gc:0wegt7BoiLbRRtjzUP0O/nnK5kWGc

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

C2

0.tcp.ap.ngrok.io:18066

Attributes

Install_directory
%ProgramData%
install_file
XClient.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2872-0-0x0000000000CE0000-0x0000000000CFA000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	Xworm5.4_rar.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	Xworm5.4_rar.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 20 IoCs

Web Service

T1102

flow	ioc
29	0.tcp.ap.ngrok.io
129	0.tcp.ap.ngrok.io
138	0.tcp.ap.ngrok.io
92	0.tcp.ap.ngrok.io
111	0.tcp.ap.ngrok.io
164	0.tcp.ap.ngrok.io
4	0.tcp.ap.ngrok.io
21	0.tcp.ap.ngrok.io
39	0.tcp.ap.ngrok.io
56	0.tcp.ap.ngrok.io
74	0.tcp.ap.ngrok.io
13	0.tcp.ap.ngrok.io
47	0.tcp.ap.ngrok.io
66	0.tcp.ap.ngrok.io
102	0.tcp.ap.ngrok.io
155	0.tcp.ap.ngrok.io
83	0.tcp.ap.ngrok.io
119	0.tcp.ap.ngrok.io
146	0.tcp.ap.ngrok.io
173	0.tcp.ap.ngrok.io

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2728	powershell.exe
2460	powershell.exe
1872	powershell.exe
1340	powershell.exe
2872	Xworm5.4_rar.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2872	Xworm5.4_rar.exe
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeDebugPrivilege	2460	powershell.exe
Token: SeDebugPrivilege	1872	powershell.exe
Token: SeDebugPrivilege	1340	powershell.exe
Token: SeDebugPrivilege	2872	Xworm5.4_rar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2872	Xworm5.4_rar.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2728	2872	Xworm5.4_rar.exe	29
PID 2872 wrote to memory of 2728	2872	Xworm5.4_rar.exe	29
PID 2872 wrote to memory of 2728	2872	Xworm5.4_rar.exe	29
PID 2872 wrote to memory of 2460	2872	Xworm5.4_rar.exe	31
PID 2872 wrote to memory of 2460	2872	Xworm5.4_rar.exe	31
PID 2872 wrote to memory of 2460	2872	Xworm5.4_rar.exe	31
PID 2872 wrote to memory of 1872	2872	Xworm5.4_rar.exe	33
PID 2872 wrote to memory of 1872	2872	Xworm5.4_rar.exe	33
PID 2872 wrote to memory of 1872	2872	Xworm5.4_rar.exe	33
PID 2872 wrote to memory of 1340	2872	Xworm5.4_rar.exe	35
PID 2872 wrote to memory of 1340	2872	Xworm5.4_rar.exe	35
PID 2872 wrote to memory of 1340	2872	Xworm5.4_rar.exe	35

C:\Users\Admin\AppData\Local\Temp\Xworm5.4_rar.exe
"C:\Users\Admin\AppData\Local\Temp\Xworm5.4_rar.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Xworm5.4_rar.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Xworm5.4_rar.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\XClient.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
e79c3520bdba1eef7957fe8c1d7af247

SHA1
b7c764640c1189ca3827ddecd63ade3344ffd3bb

SHA256
08c1a037d2ffa5a2559b3450029a35d337de3b35d3a26cd74b20ebc1d5dc2ca5

SHA512
e786b7e8ccbf41675fa62028a8808b796da1988efa23eaf091f3bb550b51493c5bded55698c5026ffbc19ad2c69f784b920022f312bab90fe4f08355c124a3b2

Download Submit
memory/1340-45-0x0000000002850000-0x00000000028D0000-memory.dmp

Filesize
512KB

Download
memory/1340-49-0x0000000002850000-0x00000000028D0000-memory.dmp

Filesize
512KB

Download
memory/1340-48-0x0000000002850000-0x00000000028D0000-memory.dmp

Filesize
512KB

Download
memory/1340-46-0x000007FEED900000-0x000007FEEE29D000-memory.dmp

Filesize
9.6MB

Download
memory/1340-44-0x000007FEED900000-0x000007FEEE29D000-memory.dmp

Filesize
9.6MB

Download
memory/1340-50-0x000007FEED900000-0x000007FEEE29D000-memory.dmp

Filesize
9.6MB

Download
memory/1872-34-0x0000000002920000-0x00000000029A0000-memory.dmp

Filesize
512KB

Download
memory/1872-38-0x000007FEEE2A0000-0x000007FEEEC3D000-memory.dmp

Filesize
9.6MB

Download
memory/1872-37-0x0000000002920000-0x00000000029A0000-memory.dmp

Filesize
512KB

Download
memory/1872-36-0x0000000002920000-0x00000000029A0000-memory.dmp

Filesize
512KB

Download
memory/1872-35-0x000007FEEE2A0000-0x000007FEEEC3D000-memory.dmp

Filesize
9.6MB

Download
memory/1872-33-0x000007FEEE2A0000-0x000007FEEEC3D000-memory.dmp

Filesize
9.6MB

Download
memory/2460-24-0x000007FEED900000-0x000007FEEE29D000-memory.dmp

Filesize
9.6MB

Download
memory/2460-20-0x000000001B250000-0x000000001B532000-memory.dmp

Filesize
2.9MB

Download
memory/2460-23-0x0000000002660000-0x00000000026E0000-memory.dmp

Filesize
512KB

Download
memory/2460-25-0x0000000002660000-0x00000000026E0000-memory.dmp

Filesize
512KB

Download
memory/2460-26-0x0000000002660000-0x00000000026E0000-memory.dmp

Filesize
512KB

Download
memory/2460-27-0x000007FEED900000-0x000007FEEE29D000-memory.dmp

Filesize
9.6MB

Download
memory/2460-22-0x000007FEED900000-0x000007FEEE29D000-memory.dmp

Filesize
9.6MB

Download
memory/2460-21-0x00000000023E0000-0x00000000023E8000-memory.dmp

Filesize
32KB

Download
memory/2728-14-0x000007FEEE2A0000-0x000007FEEEC3D000-memory.dmp

Filesize
9.6MB

Download
memory/2728-12-0x0000000002834000-0x0000000002837000-memory.dmp

Filesize
12KB

Download
memory/2728-13-0x000007FEEE2A0000-0x000007FEEEC3D000-memory.dmp

Filesize
9.6MB

Download
memory/2728-11-0x0000000002830000-0x00000000028B0000-memory.dmp

Filesize
512KB

Download
memory/2728-10-0x0000000002830000-0x00000000028B0000-memory.dmp

Filesize
512KB

Download
memory/2728-9-0x000007FEEE2A0000-0x000007FEEEC3D000-memory.dmp

Filesize
9.6MB

Download
memory/2728-8-0x0000000002410000-0x0000000002418000-memory.dmp

Filesize
32KB

Download
memory/2728-7-0x000000001B290000-0x000000001B572000-memory.dmp

Filesize
2.9MB

Download
memory/2872-0-0x0000000000CE0000-0x0000000000CFA000-memory.dmp

Filesize
104KB

Download
memory/2872-47-0x000007FEF4E40000-0x000007FEF582C000-memory.dmp

Filesize
9.9MB

Download
memory/2872-2-0x000000001AD00000-0x000000001AD80000-memory.dmp

Filesize
512KB

Download
memory/2872-1-0x000007FEF4E40000-0x000007FEF582C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing