xworm | 0aa75efa4d6847f998109301da50ff119187507f08b3119148b9db5844e7c703

General

Target

0aa75efa4d6847f998109301da50ff119187507f08b3119148b9db5844e7c703.ps1
Size

12.0MB
MD5

8520b4800af18dc9288264498350c16d
SHA1

3d3c2daf837a5faca7dbff7de7b12b6c7a066291
SHA256

0aa75efa4d6847f998109301da50ff119187507f08b3119148b9db5844e7c703
SHA512

9822c61c1c844915d6645d42319a5909bc1efb16966cad80bd153acbe02fdbdf76c546b9f341561358ab163c62a3160ad5b569efd7b976fbda502aba1378c405
SSDEEP

24576:rSUMUHnRI2kiE/ef9E+N45KZ9EqWlmevbBel/Yvn0lFwuPiJ3/V8eRSLXs3z+DWv:2vXS+5kmoQTskvKSpd1iwV0jl5

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

hjxwrm5.duckdns.org:8896

Mutex

MSmkrgH8xVI2Dczk

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2592-17-0x000001B93F240000-0x000001B93F250000-memory.dmp	family_xworm

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 3192 created 3296 3192 powershell.exe Explorer.EXE
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

description	pid	process	target process
PID 3192 created 3296	3192	powershell.exe	Explorer.EXE

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2592-17-0x000001B93F240000-0x000001B93F250000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exenotepad.exe

pid process

3192 powershell.exe
3192 powershell.exe
3192 powershell.exe
2592 notepad.exe
2592 notepad.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

Processes:

powershell.exe

pid process

3192 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exenotepad.exe

description pid process

Token: SeDebugPrivilege 3192 powershell.exe
Token: SeDebugPrivilege 2592 notepad.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

notepad.exe

pid process

2592 notepad.exe

pid	process
3192	powershell.exe
3192	powershell.exe
3192	powershell.exe
2592	notepad.exe
2592	notepad.exe

pid	process
3192	powershell.exe

description	pid	process
Token: SeDebugPrivilege	3192	powershell.exe
Token: SeDebugPrivilege	2592	notepad.exe

pid	process
2592	notepad.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe
PID 3192 wrote to memory of 2592	3192	powershell.exe	notepad.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3296

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\0aa75efa4d6847f998109301da50ff119187507f08b3119148b9db5844e7c703.ps1
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3192

C:\Windows\System32\notepad.exe
C:\Windows\System32\notepad.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3704 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:2532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gjjgncxz.ahe.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2592-16-0x000001B93D720000-0x000001B93D730000-memory.dmp

Filesize
64KB

Download
memory/2592-25-0x000001B957D10000-0x000001B957D20000-memory.dmp

Filesize
64KB

Download
memory/2592-24-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

Filesize
10.8MB

Download
memory/2592-18-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

Filesize
10.8MB

Download
memory/2592-19-0x000001B957D10000-0x000001B957D20000-memory.dmp

Filesize
64KB

Download
memory/2592-17-0x000001B93F240000-0x000001B93F250000-memory.dmp

Filesize
64KB

Download
memory/3192-12-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

Filesize
10.8MB

Download
memory/3192-15-0x000001CCA80B0000-0x000001CCA8104000-memory.dmp

Filesize
336KB

Download
memory/3192-13-0x000001CCEB030000-0x000001CCEB040000-memory.dmp

Filesize
64KB

Download
memory/3192-14-0x000001CCA8000000-0x000001CCA8053000-memory.dmp

Filesize
332KB

Download
memory/3192-11-0x000001CCEB030000-0x000001CCEB040000-memory.dmp

Filesize
64KB

Download
memory/3192-23-0x000001CCA80B0000-0x000001CCA8104000-memory.dmp

Filesize
336KB

Download
memory/3192-22-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

Filesize
10.8MB

Download
memory/3192-10-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

Filesize
10.8MB

Download
memory/3192-6-0x000001CCED0E0000-0x000001CCED102000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads