xworm | 8641f88b89c9076ece3ee571baa4b3c93ba3ac3883e90fe5f894dc41e3b7bdc7

General

Target

Ro-exec/loader-upd.exe
Size

70KB
MD5

573bd20fc8382d92a7ae9eae51e738e3
SHA1

55006093429df791f27e91a66e5ee63a81382b28
SHA256

09036ffa342f9e5bb1e31a867dcc3b60db011baba8c0d202aff1d33195cbe729
SHA512

d38736acff4128d6ce9ea17ee609ca33a37ac88f2c994cf4caf7f0eb62406a8963c33531b9f3cd020974d892c2751f3a4f67ce13ed6ba6080f97c406ccbb4aca
SSDEEP

1536:PmMfwrNATngx6fPLgD9vYebv2S5NiwWW6N9dOoihkAO:LCmn463UD6ebv242FzOoiSAO

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Attributes

Install_directory
%Public%
install_file
svchost.exe
pastebin_url
https://pastebin.com/raw/UWpQULMP

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral6/memory/3660-0-0x0000000000FE0000-0x0000000000FF8000-memory.dmp	family_xworm
behavioral6/files/0x000a000000023266-56.dat	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	loader-upd.exe

Executes dropped EXE 2 IoCs

pid	Process
2992	svchost.exe
4056	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Public\\svchost.exe"	loader-upd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs

Web Service

T1102

flow	ioc
10	pastebin.com
21	pastebin.com
25	pastebin.com
23	pastebin.com
4	pastebin.com
17	pastebin.com
19	pastebin.com
20	pastebin.com
22	pastebin.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1644	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1948	powershell.exe
1948	powershell.exe
4920	powershell.exe
4920	powershell.exe
4532	powershell.exe
4532	powershell.exe
1600	powershell.exe
1600	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3660	loader-upd.exe
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeDebugPrivilege	4920	powershell.exe
Token: SeDebugPrivilege	4532	powershell.exe
Token: SeDebugPrivilege	1600	powershell.exe
Token: SeDebugPrivilege	2992	svchost.exe
Token: SeDebugPrivilege	4056	svchost.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 1948	3660	loader-upd.exe	88
PID 3660 wrote to memory of 1948	3660	loader-upd.exe	88
PID 3660 wrote to memory of 4920	3660	loader-upd.exe	90
PID 3660 wrote to memory of 4920	3660	loader-upd.exe	90
PID 3660 wrote to memory of 4532	3660	loader-upd.exe	92
PID 3660 wrote to memory of 4532	3660	loader-upd.exe	92
PID 3660 wrote to memory of 1600	3660	loader-upd.exe	94
PID 3660 wrote to memory of 1600	3660	loader-upd.exe	94
PID 3660 wrote to memory of 1644	3660	loader-upd.exe	96
PID 3660 wrote to memory of 1644	3660	loader-upd.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Ro-exec\loader-upd.exe
"C:\Users\Admin\AppData\Local\Temp\Ro-exec\loader-upd.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Ro-exec\loader-upd.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'loader-upd.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\svchost.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1600
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Public\svchost.exe"
  2⤵
  - Creates scheduled task(s)
  PID:1644

C:\Users\Public\svchost.exe
C:\Users\Public\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2992

C:\Users\Public\svchost.exe
C:\Users\Public\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1b662a0da53b1e3a1a4e100e36c4fa0d

SHA1
7aa819b5f5bb9a47aaabef5311b81892d9b19629

SHA256
f4f91f5d42193856310c988575877268a21f1427904efb380b3443d14c5f32ec

SHA512
79b3ed1d1ccdabb4cb354112091de7f282ecf4b2c415ea77538a0697f9855423fd3f1d165f9250f73540fde468174a2fe544052fcb6d6574bfd98b005af9b8b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
96e3b86880fedd5afc001d108732a3e5

SHA1
8fc17b39d744a9590a6d5897012da5e6757439a3

SHA256
c3077e4cadb4ed246c02abe55aa6cf832fee4c2546b7addb7d22cd1c7c8c1294

SHA512
909b1968f7204fa7029109b02232d8cc5438f6b4dc7c9044e4e47c59fcee538199b13029e36592b12ed573d48a308dd4822d2ced4129ab08d4111897e02be55d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2utg0eua.ata.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Public\svchost.exe

Filesize
70KB

MD5
573bd20fc8382d92a7ae9eae51e738e3

SHA1
55006093429df791f27e91a66e5ee63a81382b28

SHA256
09036ffa342f9e5bb1e31a867dcc3b60db011baba8c0d202aff1d33195cbe729

SHA512
d38736acff4128d6ce9ea17ee609ca33a37ac88f2c994cf4caf7f0eb62406a8963c33531b9f3cd020974d892c2751f3a4f67ce13ed6ba6080f97c406ccbb4aca

Download Submit
memory/1948-13-0x0000028E75AB0000-0x0000028E75AC0000-memory.dmp

Filesize
64KB

Download
memory/1948-17-0x00007FFA33CB0000-0x00007FFA34771000-memory.dmp

Filesize
10.8MB

Download
memory/1948-7-0x0000028E5D520000-0x0000028E5D542000-memory.dmp

Filesize
136KB

Download
memory/1948-14-0x0000028E75AB0000-0x0000028E75AC0000-memory.dmp

Filesize
64KB

Download
memory/1948-12-0x00007FFA33CB0000-0x00007FFA34771000-memory.dmp

Filesize
10.8MB

Download
memory/3660-0-0x0000000000FE0000-0x0000000000FF8000-memory.dmp

Filesize
96KB

Download
memory/3660-53-0x000000001BD10000-0x000000001BD20000-memory.dmp

Filesize
64KB

Download
memory/3660-54-0x00007FFA33CB0000-0x00007FFA34771000-memory.dmp

Filesize
10.8MB

Download
memory/3660-55-0x000000001BD10000-0x000000001BD20000-memory.dmp

Filesize
64KB

Download
memory/3660-1-0x00007FFA33CB0000-0x00007FFA34771000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads