xworm | 2fab71d50a3b02c3729bde4f28e489b2346aac1829c467e19284741d34f0cf03

General

Target

A.exe
Size

50KB
MD5

a0de54573621a87cd95ce56ce7ab7a43
SHA1

c3d84eddaffcb63943627e4ba00c3c58200e4da3
SHA256

2fab71d50a3b02c3729bde4f28e489b2346aac1829c467e19284741d34f0cf03
SHA512

85606cdd15e70a067475f9f4352d98dd054228a56da7c22e69d88c91a8371dbfdbc2bb391c0d4118e4bd7a2e3e28a060887b4c28ba95c76c8757a184fcc7915c
SSDEEP

1536:Hf05a/CTjuX89IFc9Uy68OMNGadS1EAd8IIA:Hf05a/CTKM9IFc9U4OM9gEA6IIA

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

85.203.4.127:1474

Mutex

i1kB13VVw1GEf0Fq

Attributes

Install_directory
%ProgramData%
install_file
VLC_Media.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2924-0-0x00000000001F0000-0x0000000000202000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Drops startup file 2 IoCs

Processes:

A.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VLC_Media.lnk	A.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VLC_Media.lnk	A.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeA.exe

pid process

2552 powershell.exe
2656 powershell.exe
2336 powershell.exe
2792 powershell.exe
2924 A.exe

flow	ioc
4	ip-api.com

pid	process
2552	powershell.exe
2656	powershell.exe
2336	powershell.exe
2792	powershell.exe
2924	A.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

A.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2924	A.exe
Token: SeDebugPrivilege	2552	powershell.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	2336	powershell.exe
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeDebugPrivilege	2924	A.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

A.exe

pid process

2924 A.exe

pid	process
2924	A.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

A.exe

description	pid	process	target process
PID 2924 wrote to memory of 2552	2924	A.exe	powershell.exe
PID 2924 wrote to memory of 2552	2924	A.exe	powershell.exe
PID 2924 wrote to memory of 2552	2924	A.exe	powershell.exe
PID 2924 wrote to memory of 2656	2924	A.exe	powershell.exe
PID 2924 wrote to memory of 2656	2924	A.exe	powershell.exe
PID 2924 wrote to memory of 2656	2924	A.exe	powershell.exe
PID 2924 wrote to memory of 2336	2924	A.exe	powershell.exe
PID 2924 wrote to memory of 2336	2924	A.exe	powershell.exe
PID 2924 wrote to memory of 2336	2924	A.exe	powershell.exe
PID 2924 wrote to memory of 2792	2924	A.exe	powershell.exe
PID 2924 wrote to memory of 2792	2924	A.exe	powershell.exe
PID 2924 wrote to memory of 2792	2924	A.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\A.exe
"C:\Users\Admin\AppData\Local\Temp\A.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\A.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2552

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'A.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2656

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\VLC_Media.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2336

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'VLC_Media.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2792

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
8f296c00648ad0911c82a92e24cfafde

SHA1
7255249965c67ce3e41ca0a800caf543374172bb

SHA256
7f511884b58131c3b999a4fb2cdf37ffd84b7eb620af8bcc48afbd604bfc7944

SHA512
3a049707907ef94c431ffdac76aae868751895b3eb9cefae5343d824764e64e68c2264bf3696229a0a89b6fb3ab7843025b3bb81b0b5c12ee8390df9a3f77a1e

Download Submit
memory/2336-42-0x000007FEEEA10000-0x000007FEEF3AD000-memory.dmp

Filesize
9.6MB

Download
memory/2336-40-0x00000000029AB000-0x0000000002A12000-memory.dmp

Filesize
412KB

Download
memory/2336-41-0x000007FEEEA10000-0x000007FEEF3AD000-memory.dmp

Filesize
9.6MB

Download
memory/2336-38-0x00000000029A0000-0x0000000002A20000-memory.dmp

Filesize
512KB

Download
memory/2336-36-0x00000000029A0000-0x0000000002A20000-memory.dmp

Filesize
512KB

Download
memory/2336-37-0x00000000029A0000-0x0000000002A20000-memory.dmp

Filesize
512KB

Download
memory/2336-35-0x000007FEEEA10000-0x000007FEEF3AD000-memory.dmp

Filesize
9.6MB

Download
memory/2552-13-0x0000000002A80000-0x0000000002B00000-memory.dmp

Filesize
512KB

Download
memory/2552-11-0x000007FEEEA10000-0x000007FEEF3AD000-memory.dmp

Filesize
9.6MB

Download
memory/2552-14-0x0000000002A80000-0x0000000002B00000-memory.dmp

Filesize
512KB

Download
memory/2552-15-0x000007FEEEA10000-0x000007FEEF3AD000-memory.dmp

Filesize
9.6MB

Download
memory/2552-12-0x0000000002A80000-0x0000000002B00000-memory.dmp

Filesize
512KB

Download
memory/2552-7-0x000000001B550000-0x000000001B832000-memory.dmp

Filesize
2.9MB

Download
memory/2552-9-0x00000000028A0000-0x00000000028A8000-memory.dmp

Filesize
32KB

Download
memory/2552-8-0x000007FEEEA10000-0x000007FEEF3AD000-memory.dmp

Filesize
9.6MB

Download
memory/2552-10-0x0000000002A80000-0x0000000002B00000-memory.dmp

Filesize
512KB

Download
memory/2656-22-0x000007FEEE070000-0x000007FEEEA0D000-memory.dmp

Filesize
9.6MB

Download
memory/2656-21-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/2656-27-0x0000000002780000-0x0000000002800000-memory.dmp

Filesize
512KB

Download
memory/2656-28-0x0000000002780000-0x0000000002800000-memory.dmp

Filesize
512KB

Download
memory/2656-29-0x000007FEEE070000-0x000007FEEEA0D000-memory.dmp

Filesize
9.6MB

Download
memory/2656-25-0x000007FEEE070000-0x000007FEEEA0D000-memory.dmp

Filesize
9.6MB

Download
memory/2656-26-0x0000000002780000-0x0000000002800000-memory.dmp

Filesize
512KB

Download
memory/2656-24-0x0000000002780000-0x0000000002800000-memory.dmp

Filesize
512KB

Download
memory/2656-23-0x0000000002870000-0x0000000002878000-memory.dmp

Filesize
32KB

Download
memory/2792-48-0x000007FEEE070000-0x000007FEEEA0D000-memory.dmp

Filesize
9.6MB

Download
memory/2792-49-0x0000000002A00000-0x0000000002A80000-memory.dmp

Filesize
512KB

Download
memory/2792-50-0x000007FEEE070000-0x000007FEEEA0D000-memory.dmp

Filesize
9.6MB

Download
memory/2792-51-0x0000000002A00000-0x0000000002A80000-memory.dmp

Filesize
512KB

Download
memory/2792-52-0x0000000002A00000-0x0000000002A80000-memory.dmp

Filesize
512KB

Download
memory/2792-53-0x000007FEEE070000-0x000007FEEEA0D000-memory.dmp

Filesize
9.6MB

Download
memory/2924-39-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmp

Filesize
9.9MB

Download
memory/2924-2-0x000000001B1A0000-0x000000001B220000-memory.dmp

Filesize
512KB

Download
memory/2924-1-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmp

Filesize
9.9MB

Download
memory/2924-0-0x00000000001F0000-0x0000000000202000-memory.dmp

Filesize
72KB

Download
memory/2924-58-0x000000001B1A0000-0x000000001B220000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads