xworm | 3f1e8e3609e6ffd53453d5ce0ca33dc7eaf06e55085d7f6c43d0c4b6df1f974f

General

Target

3f1e8e3609e6ffd53453d5ce0ca33dc7eaf06e55085d7f6c43d0c4b6df1f974f.exe
Size

166KB
MD5

67183ea2fdfbaace4c265de91e218c59
SHA1

a66c33b7d7d27bc5153f53d672b2f7c7d36c2ae8
SHA256

3f1e8e3609e6ffd53453d5ce0ca33dc7eaf06e55085d7f6c43d0c4b6df1f974f
SHA512

0eca1d1f216e81c6000ab24d9c25f25ed5f6d7a2d5b97c73093ffb771c399e8b98e1b95890ff0d0326a6f00f9c2606947c03aa91a30c9b7d0106b34dc0978622
SSDEEP

3072:ubYexkjTk/btjQAzsOSrDGM+lmsolAIrRuw+mqv9j1MWLQZ:u0e62byAzw+lDAA

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

93.123.39.225:7000

Attributes

Install_directory
%AppData%
install_file
XClient.exe
telegram
https://api.telegram.org/bot6769459273:AAE8rusUI57P-Uj11j60b70AidMpGMPPq1E/sendMessage?chat_id=6862736136

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2512-0-0x0000000000D40000-0x0000000000D70000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	3f1e8e3609e6ffd53453d5ce0ca33dc7eaf06e55085d7f6c43d0c4b6df1f974f.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	3f1e8e3609e6ffd53453d5ce0ca33dc7eaf06e55085d7f6c43d0c4b6df1f974f.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	3f1e8e3609e6ffd53453d5ce0ca33dc7eaf06e55085d7f6c43d0c4b6df1f974f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2512	3f1e8e3609e6ffd53453d5ce0ca33dc7eaf06e55085d7f6c43d0c4b6df1f974f.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1680	powershell.exe
2644	powershell.exe
2464	powershell.exe
2508	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2512	3f1e8e3609e6ffd53453d5ce0ca33dc7eaf06e55085d7f6c43d0c4b6df1f974f.exe
Token: SeDebugPrivilege	1680	powershell.exe
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeDebugPrivilege	2464	powershell.exe
Token: SeDebugPrivilege	2508	powershell.exe
Token: SeDebugPrivilege	2512	3f1e8e3609e6ffd53453d5ce0ca33dc7eaf06e55085d7f6c43d0c4b6df1f974f.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1680	2512	3f1e8e3609e6ffd53453d5ce0ca33dc7eaf06e55085d7f6c43d0c4b6df1f974f.exe	28
PID 2512 wrote to memory of 1680	2512	3f1e8e3609e6ffd53453d5ce0ca33dc7eaf06e55085d7f6c43d0c4b6df1f974f.exe	28
PID 2512 wrote to memory of 1680	2512	3f1e8e3609e6ffd53453d5ce0ca33dc7eaf06e55085d7f6c43d0c4b6df1f974f.exe	28
PID 2512 wrote to memory of 2644	2512	3f1e8e3609e6ffd53453d5ce0ca33dc7eaf06e55085d7f6c43d0c4b6df1f974f.exe	30
PID 2512 wrote to memory of 2644	2512	3f1e8e3609e6ffd53453d5ce0ca33dc7eaf06e55085d7f6c43d0c4b6df1f974f.exe	30
PID 2512 wrote to memory of 2644	2512	3f1e8e3609e6ffd53453d5ce0ca33dc7eaf06e55085d7f6c43d0c4b6df1f974f.exe	30
PID 2512 wrote to memory of 2464	2512	3f1e8e3609e6ffd53453d5ce0ca33dc7eaf06e55085d7f6c43d0c4b6df1f974f.exe	32
PID 2512 wrote to memory of 2464	2512	3f1e8e3609e6ffd53453d5ce0ca33dc7eaf06e55085d7f6c43d0c4b6df1f974f.exe	32
PID 2512 wrote to memory of 2464	2512	3f1e8e3609e6ffd53453d5ce0ca33dc7eaf06e55085d7f6c43d0c4b6df1f974f.exe	32
PID 2512 wrote to memory of 2508	2512	3f1e8e3609e6ffd53453d5ce0ca33dc7eaf06e55085d7f6c43d0c4b6df1f974f.exe	34
PID 2512 wrote to memory of 2508	2512	3f1e8e3609e6ffd53453d5ce0ca33dc7eaf06e55085d7f6c43d0c4b6df1f974f.exe	34
PID 2512 wrote to memory of 2508	2512	3f1e8e3609e6ffd53453d5ce0ca33dc7eaf06e55085d7f6c43d0c4b6df1f974f.exe	34

C:\Users\Admin\AppData\Local\Temp\3f1e8e3609e6ffd53453d5ce0ca33dc7eaf06e55085d7f6c43d0c4b6df1f974f.exe
"C:\Users\Admin\AppData\Local\Temp\3f1e8e3609e6ffd53453d5ce0ca33dc7eaf06e55085d7f6c43d0c4b6df1f974f.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\3f1e8e3609e6ffd53453d5ce0ca33dc7eaf06e55085d7f6c43d0c4b6df1f974f.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '3f1e8e3609e6ffd53453d5ce0ca33dc7eaf06e55085d7f6c43d0c4b6df1f974f.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
373ac5e61769b35afa2fbee366403b15

SHA1
faafc85fc273579368ff64710767e40411432840

SHA256
6f94d142a153d28614362345d05a885cb6c5b07b50407bf940eff4d3a0507d69

SHA512
ce543c5a9602f8ed27b7c6c0d8eab75f15002a7739de3905351808e34f6921f0474953767da56fdf7f591bee735e5096a4aa01cfa554baac0a243e074065ffdd

Download Submit
memory/1680-9-0x0000000001EF0000-0x0000000001F70000-memory.dmp

Filesize
512KB

Download
memory/1680-10-0x0000000001EF0000-0x0000000001F70000-memory.dmp

Filesize
512KB

Download
memory/1680-7-0x0000000001FC0000-0x0000000001FC8000-memory.dmp

Filesize
32KB

Download
memory/1680-8-0x000007FEF2460000-0x000007FEF2DFD000-memory.dmp

Filesize
9.6MB

Download
memory/1680-12-0x000007FEF2460000-0x000007FEF2DFD000-memory.dmp

Filesize
9.6MB

Download
memory/1680-11-0x0000000001EF0000-0x0000000001F70000-memory.dmp

Filesize
512KB

Download
memory/1680-6-0x000000001B740000-0x000000001BA22000-memory.dmp

Filesize
2.9MB

Download
memory/1680-13-0x000007FEF2460000-0x000007FEF2DFD000-memory.dmp

Filesize
9.6MB

Download
memory/2464-33-0x0000000001D00000-0x0000000001D80000-memory.dmp

Filesize
512KB

Download
memory/2464-39-0x000007FEF2460000-0x000007FEF2DFD000-memory.dmp

Filesize
9.6MB

Download
memory/2464-32-0x000007FEF2460000-0x000007FEF2DFD000-memory.dmp

Filesize
9.6MB

Download
memory/2464-34-0x000007FEF2460000-0x000007FEF2DFD000-memory.dmp

Filesize
9.6MB

Download
memory/2464-35-0x0000000001D00000-0x0000000001D80000-memory.dmp

Filesize
512KB

Download
memory/2464-36-0x0000000001D00000-0x0000000001D80000-memory.dmp

Filesize
512KB

Download
memory/2464-38-0x0000000001D00000-0x0000000001D80000-memory.dmp

Filesize
512KB

Download
memory/2508-46-0x00000000029A0000-0x0000000002A20000-memory.dmp

Filesize
512KB

Download
memory/2508-45-0x000007FEEF2C0000-0x000007FEEFC5D000-memory.dmp

Filesize
9.6MB

Download
memory/2508-51-0x000007FEEF2C0000-0x000007FEEFC5D000-memory.dmp

Filesize
9.6MB

Download
memory/2508-47-0x000007FEEF2C0000-0x000007FEEFC5D000-memory.dmp

Filesize
9.6MB

Download
memory/2508-48-0x00000000029A0000-0x0000000002A20000-memory.dmp

Filesize
512KB

Download
memory/2508-49-0x00000000029A0000-0x0000000002A20000-memory.dmp

Filesize
512KB

Download
memory/2508-50-0x00000000029A0000-0x0000000002A20000-memory.dmp

Filesize
512KB

Download
memory/2512-37-0x000007FEF5D70000-0x000007FEF675C000-memory.dmp

Filesize
9.9MB

Download
memory/2512-1-0x000007FEF5D70000-0x000007FEF675C000-memory.dmp

Filesize
9.9MB

Download
memory/2512-0-0x0000000000D40000-0x0000000000D70000-memory.dmp

Filesize
192KB

Download
memory/2512-56-0x000000001B4C0000-0x000000001B540000-memory.dmp

Filesize
512KB

Download
memory/2512-57-0x000000001B4C0000-0x000000001B540000-memory.dmp

Filesize
512KB

Download
memory/2644-22-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/2644-20-0x000007FEEF2C0000-0x000007FEEFC5D000-memory.dmp

Filesize
9.6MB

Download
memory/2644-21-0x0000000002D60000-0x0000000002DE0000-memory.dmp

Filesize
512KB

Download
memory/2644-19-0x000000001B580000-0x000000001B862000-memory.dmp

Filesize
2.9MB

Download
memory/2644-24-0x0000000002D60000-0x0000000002DE0000-memory.dmp

Filesize
512KB

Download
memory/2644-23-0x000007FEEF2C0000-0x000007FEEFC5D000-memory.dmp

Filesize
9.6MB

Download
memory/2644-25-0x0000000002D60000-0x0000000002DE0000-memory.dmp

Filesize
512KB

Download
memory/2644-26-0x000007FEEF2C0000-0x000007FEEFC5D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads