xworm | 2fab71d50a3b02c3729bde4f28e489b2346aac1829c467e19284741d34f0cf03

General

Target

A.exe
Size

50KB
MD5

a0de54573621a87cd95ce56ce7ab7a43
SHA1

c3d84eddaffcb63943627e4ba00c3c58200e4da3
SHA256

2fab71d50a3b02c3729bde4f28e489b2346aac1829c467e19284741d34f0cf03
SHA512

85606cdd15e70a067475f9f4352d98dd054228a56da7c22e69d88c91a8371dbfdbc2bb391c0d4118e4bd7a2e3e28a060887b4c28ba95c76c8757a184fcc7915c
SSDEEP

1536:Hf05a/CTjuX89IFc9Uy68OMNGadS1EAd8IIA:Hf05a/CTKM9IFc9U4OM9gEA6IIA

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

85.203.4.127:1474

Mutex

i1kB13VVw1GEf0Fq

Attributes

Install_directory
%ProgramData%
install_file
VLC_Media.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2916-0-0x0000000000C00000-0x0000000000C12000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Drops startup file 2 IoCs

Processes:

A.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VLC_Media.lnk	A.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VLC_Media.lnk	A.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeA.exe

pid process

2808 powershell.exe
2476 powershell.exe
1592 powershell.exe
1636 powershell.exe
2916 A.exe

flow	ioc
4	ip-api.com

pid	process
2808	powershell.exe
2476	powershell.exe
1592	powershell.exe
1636	powershell.exe
2916	A.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

A.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2916	A.exe
Token: SeDebugPrivilege	2808	powershell.exe
Token: SeDebugPrivilege	2476	powershell.exe
Token: SeDebugPrivilege	1592	powershell.exe
Token: SeDebugPrivilege	1636	powershell.exe
Token: SeDebugPrivilege	2916	A.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

A.exe

pid process

2916 A.exe

pid	process
2916	A.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

A.exe

description	pid	process	target process
PID 2916 wrote to memory of 2808	2916	A.exe	powershell.exe
PID 2916 wrote to memory of 2808	2916	A.exe	powershell.exe
PID 2916 wrote to memory of 2808	2916	A.exe	powershell.exe
PID 2916 wrote to memory of 2476	2916	A.exe	powershell.exe
PID 2916 wrote to memory of 2476	2916	A.exe	powershell.exe
PID 2916 wrote to memory of 2476	2916	A.exe	powershell.exe
PID 2916 wrote to memory of 1592	2916	A.exe	powershell.exe
PID 2916 wrote to memory of 1592	2916	A.exe	powershell.exe
PID 2916 wrote to memory of 1592	2916	A.exe	powershell.exe
PID 2916 wrote to memory of 1636	2916	A.exe	powershell.exe
PID 2916 wrote to memory of 1636	2916	A.exe	powershell.exe
PID 2916 wrote to memory of 1636	2916	A.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\A.exe
"C:\Users\Admin\AppData\Local\Temp\A.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\A.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2808

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'A.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2476

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\VLC_Media.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1592

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'VLC_Media.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1636

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
401b6f78b13a4b282362403f57e8d741

SHA1
267d7adaa904c9e10bf839888c193641eab6c279

SHA256
4f2d2d18f9c61f0df1dfa00d9b790ce826c34c61d805d2f0f627735ea47448c8

SHA512
8a5fbbbf3fce51e89dc49264e80a5cafacc1d30f00714a1cea6f8b75bd762d08778f00dc6e07716d2237c1cf265f19735abe2567e885f5992d533b7a25d607ea

Download Submit
memory/1592-41-0x000007FEEEA10000-0x000007FEEF3AD000-memory.dmp

Filesize
9.6MB

Download
memory/1592-40-0x0000000002C0B000-0x0000000002C72000-memory.dmp

Filesize
412KB

Download
memory/1592-39-0x0000000002C00000-0x0000000002C80000-memory.dmp

Filesize
512KB

Download
memory/1592-36-0x0000000002C00000-0x0000000002C80000-memory.dmp

Filesize
512KB

Download
memory/1592-38-0x0000000002C00000-0x0000000002C80000-memory.dmp

Filesize
512KB

Download
memory/1592-37-0x000007FEEEA10000-0x000007FEEF3AD000-memory.dmp

Filesize
9.6MB

Download
memory/1592-35-0x000007FEEEA10000-0x000007FEEF3AD000-memory.dmp

Filesize
9.6MB

Download
memory/1636-50-0x0000000002900000-0x0000000002980000-memory.dmp

Filesize
512KB

Download
memory/1636-48-0x0000000002900000-0x0000000002980000-memory.dmp

Filesize
512KB

Download
memory/1636-47-0x000007FEEE070000-0x000007FEEEA0D000-memory.dmp

Filesize
9.6MB

Download
memory/1636-52-0x0000000002900000-0x0000000002980000-memory.dmp

Filesize
512KB

Download
memory/1636-51-0x0000000002900000-0x0000000002980000-memory.dmp

Filesize
512KB

Download
memory/1636-49-0x000007FEEE070000-0x000007FEEEA0D000-memory.dmp

Filesize
9.6MB

Download
memory/1636-53-0x000007FEEE070000-0x000007FEEEA0D000-memory.dmp

Filesize
9.6MB

Download
memory/2476-26-0x000007FEEE070000-0x000007FEEEA0D000-memory.dmp

Filesize
9.6MB

Download
memory/2476-23-0x0000000002310000-0x0000000002318000-memory.dmp

Filesize
32KB

Download
memory/2476-22-0x000007FEEE070000-0x000007FEEEA0D000-memory.dmp

Filesize
9.6MB

Download
memory/2476-24-0x0000000002990000-0x0000000002A10000-memory.dmp

Filesize
512KB

Download
memory/2476-21-0x000000001B510000-0x000000001B7F2000-memory.dmp

Filesize
2.9MB

Download
memory/2476-28-0x0000000002990000-0x0000000002A10000-memory.dmp

Filesize
512KB

Download
memory/2476-29-0x000007FEEE070000-0x000007FEEEA0D000-memory.dmp

Filesize
9.6MB

Download
memory/2476-25-0x0000000002990000-0x0000000002A10000-memory.dmp

Filesize
512KB

Download
memory/2808-14-0x00000000029B0000-0x0000000002A30000-memory.dmp

Filesize
512KB

Download
memory/2808-15-0x000007FEEEA10000-0x000007FEEF3AD000-memory.dmp

Filesize
9.6MB

Download
memory/2808-13-0x00000000029B0000-0x0000000002A30000-memory.dmp

Filesize
512KB

Download
memory/2808-12-0x00000000029B0000-0x0000000002A30000-memory.dmp

Filesize
512KB

Download
memory/2808-11-0x000007FEEEA10000-0x000007FEEF3AD000-memory.dmp

Filesize
9.6MB

Download
memory/2808-7-0x000007FEEEA10000-0x000007FEEF3AD000-memory.dmp

Filesize
9.6MB

Download
memory/2808-10-0x0000000002690000-0x0000000002698000-memory.dmp

Filesize
32KB

Download
memory/2808-9-0x00000000029B0000-0x0000000002A30000-memory.dmp

Filesize
512KB

Download
memory/2808-8-0x000000001B730000-0x000000001BA12000-memory.dmp

Filesize
2.9MB

Download
memory/2916-27-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmp

Filesize
9.9MB

Download
memory/2916-0-0x0000000000C00000-0x0000000000C12000-memory.dmp

Filesize
72KB

Download
memory/2916-2-0x000000001B390000-0x000000001B410000-memory.dmp

Filesize
512KB

Download
memory/2916-1-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads