xworm | 66ea6f59f2e2fcbe43cd254fb6ba978131dc8d36ba1b68499f62d218827ba3bb

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2024 13:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XClient.exe
Size

51KB
MD5

0d125aea70c014089008f124008cdee7
SHA1

3518a9d5980b3621c60cda2d67852547afefff88
SHA256

66ea6f59f2e2fcbe43cd254fb6ba978131dc8d36ba1b68499f62d218827ba3bb
SHA512

e35ba58854a4276857343c284476e6aa28af7a45888f1cd86c8c37054f0bd23432f94cc4fc5255f7adbad2feff78bc7d746184a01f5cb5e10b0cc7f801760d49
SSDEEP

1536:H9E87iZtQqEp3n1lIvmzbqoaz1rutOgO6Md:H9EJZaJBn1lomzbqTrutOgO6M

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

3.1

193.161.193.99:50291

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/3400-0-0x0000000000050000-0x0000000000064000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3400	XClient.exe

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
PID:3400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3400-0-0x0000000000050000-0x0000000000064000-memory.dmp

Filesize
80KB

Download
memory/3400-1-0x00007FF82F4A0000-0x00007FF82FF61000-memory.dmp

Filesize
10.8MB

Download
memory/3400-6-0x000000001AC60000-0x000000001AC70000-memory.dmp

Filesize
64KB

Download
memory/3400-7-0x00007FF82F4A0000-0x00007FF82FF61000-memory.dmp

Filesize
10.8MB

Download