xworm | 610e127f79bb023801c4964d5fb4ce85f8cc145f54be11eb3dbe685c5e927db0

General

Target

Mercurial.exe
Size

3.4MB
MD5

098e9faf57bdcda0314e4f43cfbe9686
SHA1

3a245eedb31cafc62d3672885875489551b69283
SHA256

610e127f79bb023801c4964d5fb4ce85f8cc145f54be11eb3dbe685c5e927db0
SHA512

202e533c0a0a535add4e6a19a04b2fa36e486a3b058981d522cc2b961af4dd189d69f20cf77aebad31bc5e1eaef183a4ed6d6948c62ea7ceabd226a7c9fe05b1
SSDEEP

98304:hNkjozJ9/im8XVBKl6t1buVfRhq+5tXzgCa/T:hxzJpjS346t1bIfuq07

Score

10^/10

xworm agilenet rat trojan

Malware Config

Extracted

Family

xworm

C2

147.185.221.17:53478

Attributes

Install_directory
%Temp%
install_file
Runbroker.exe

Signatures

Detect Xworm Payload 2 IoCs

Processes:

resource	yara_rule
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\E.EXE	family_xworm
behavioral3/memory/3492-14-0x0000000000080000-0x0000000000098000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Drops startup file 2 IoCs

Processes:

E.EXE

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runbroker.lnk	E.EXE
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runbroker.lnk	E.EXE

Executes dropped EXE 2 IoCs

Processes:

E.EXEMERCURIAL.EXE

pid process

3492 E.EXE
3656 MERCURIAL.EXE

pid	process
3492	E.EXE
3656	MERCURIAL.EXE

Obfuscated with Agile.Net obfuscator 11 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral3/memory/3656-36-0x0000000005270000-0x000000000528E000-memory.dmp	agile_net
behavioral3/memory/3656-39-0x0000000005310000-0x000000000531E000-memory.dmp	agile_net
behavioral3/memory/3656-40-0x0000000005B80000-0x0000000005CCA000-memory.dmp	agile_net
behavioral3/memory/3656-38-0x00000000052F0000-0x00000000052FE000-memory.dmp	agile_net
behavioral3/memory/3656-37-0x00000000052B0000-0x00000000052E6000-memory.dmp	agile_net
behavioral3/memory/3656-35-0x00000000051F0000-0x000000000525E000-memory.dmp	agile_net
behavioral3/memory/3656-34-0x00000000051E0000-0x00000000051F4000-memory.dmp	agile_net
behavioral3/memory/3656-33-0x00000000051D0000-0x00000000051E0000-memory.dmp	agile_net
behavioral3/memory/3656-32-0x00000000051A0000-0x00000000051C0000-memory.dmp	agile_net
behavioral3/memory/3656-31-0x0000000005180000-0x00000000051A0000-memory.dmp	agile_net
behavioral3/memory/3656-30-0x0000000005040000-0x000000000505C000-memory.dmp	agile_net

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

MERCURIAL.EXEE.EXE

pid	process
3656	MERCURIAL.EXE
3656	MERCURIAL.EXE
3656	MERCURIAL.EXE
3656	MERCURIAL.EXE
3656	MERCURIAL.EXE
3656	MERCURIAL.EXE
3656	MERCURIAL.EXE
3656	MERCURIAL.EXE
3492	E.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

E.EXEMERCURIAL.EXE

description pid process

Token: SeDebugPrivilege 3492 E.EXE
Token: SeDebugPrivilege 3656 MERCURIAL.EXE
Token: SeDebugPrivilege 3492 E.EXE
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

E.EXE

pid process

3492 E.EXE

description	pid	process
Token: SeDebugPrivilege	3492	E.EXE
Token: SeDebugPrivilege	3656	MERCURIAL.EXE
Token: SeDebugPrivilege	3492	E.EXE

pid	process
3492	E.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

Mercurial.exe

description	pid	process	target process
PID 416 wrote to memory of 3492	416	Mercurial.exe	E.EXE
PID 416 wrote to memory of 3492	416	Mercurial.exe	E.EXE
PID 416 wrote to memory of 3656	416	Mercurial.exe	MERCURIAL.EXE
PID 416 wrote to memory of 3656	416	Mercurial.exe	MERCURIAL.EXE
PID 416 wrote to memory of 3656	416	Mercurial.exe	MERCURIAL.EXE

C:\Users\Admin\AppData\Local\Temp\Mercurial.exe
"C:\Users\Admin\AppData\Local\Temp\Mercurial.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:416

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\E.EXE
"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\E.EXE"
2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3492

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\MERCURIAL.EXE
"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\MERCURIAL.EXE"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3656

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\E.EXE
Filesize
71KB

MD5
fc1ffcb6cb37e5c7f5222ab764cbd64a

SHA1
e213083ec8f538a512892e0d03546e9d509deb47

SHA256
452fad43428918730f5fdd74953065b2359aa021ab05052d4cdfdaf15c28c3f2

SHA512
57ab086d049c4de13fe9673f7ea6d11f8109818214ae01e3cdf501c3b738f89dccab800f4e47476c21415e048e8424cb445780686f9090a7ede7dbbdd7e97fb4

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\MERCURIAL.EXE
Filesize
3.2MB

MD5
a9477b3e21018b96fc5d2264d4016e65

SHA1
493fa8da8bf89ea773aeb282215f78219a5401b7

SHA256
890fd59af3370e2ce12e0d11916d1ad4ee9b9c267c434347dbed11e9572e8645

SHA512
66529a656865400fe37d40ae125a1d057f8be5aa17da80d367ebbe1a9dcea38f5174870d0dc5b56771f6ca5a13e2fad22d803f5357f3ef59a46e3bdf0cc5ee9c

Download Submit
memory/3492-14-0x0000000000080000-0x0000000000098000-memory.dmp

Filesize
96KB

Download
memory/3492-23-0x00007FFE54DB0000-0x00007FFE55872000-memory.dmp

Filesize
10.8MB

Download
memory/3492-57-0x0000000002080000-0x0000000002090000-memory.dmp

Filesize
64KB

Download
memory/3492-52-0x00007FFE54DB0000-0x00007FFE55872000-memory.dmp

Filesize
10.8MB

Download
memory/3656-41-0x0000000005CD0000-0x0000000005DE6000-memory.dmp

Filesize
1.1MB

Download
memory/3656-31-0x0000000005180000-0x00000000051A0000-memory.dmp

Filesize
128KB

Download
memory/3656-28-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/3656-29-0x0000000004F20000-0x0000000004F2A000-memory.dmp

Filesize
40KB

Download
memory/3656-36-0x0000000005270000-0x000000000528E000-memory.dmp

Filesize
120KB

Download
memory/3656-39-0x0000000005310000-0x000000000531E000-memory.dmp

Filesize
56KB

Download
memory/3656-40-0x0000000005B80000-0x0000000005CCA000-memory.dmp

Filesize
1.3MB

Download
memory/3656-38-0x00000000052F0000-0x00000000052FE000-memory.dmp

Filesize
56KB

Download
memory/3656-37-0x00000000052B0000-0x00000000052E6000-memory.dmp

Filesize
216KB

Download
memory/3656-42-0x0000000005B40000-0x0000000005B70000-memory.dmp

Filesize
192KB

Download
memory/3656-25-0x0000000074A20000-0x00000000751D1000-memory.dmp

Filesize
7.7MB

Download
memory/3656-35-0x00000000051F0000-0x000000000525E000-memory.dmp

Filesize
440KB

Download
memory/3656-34-0x00000000051E0000-0x00000000051F4000-memory.dmp

Filesize
80KB

Download
memory/3656-33-0x00000000051D0000-0x00000000051E0000-memory.dmp

Filesize
64KB

Download
memory/3656-32-0x00000000051A0000-0x00000000051C0000-memory.dmp

Filesize
128KB

Download
memory/3656-27-0x0000000004F30000-0x0000000004FC2000-memory.dmp

Filesize
584KB

Download
memory/3656-30-0x0000000005040000-0x000000000505C000-memory.dmp

Filesize
112KB

Download
memory/3656-43-0x0000000008890000-0x0000000008898000-memory.dmp

Filesize
32KB

Download
memory/3656-44-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/3656-45-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/3656-46-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/3656-51-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/3656-26-0x0000000005440000-0x00000000059E6000-memory.dmp

Filesize
5.6MB

Download
memory/3656-53-0x0000000074A20000-0x00000000751D1000-memory.dmp

Filesize
7.7MB

Download
memory/3656-54-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/3656-55-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/3656-56-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/3656-24-0x0000000000120000-0x000000000045A000-memory.dmp

Filesize
3.2MB

Download
memory/3656-58-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads