xworm | 19484f6840c4f4c21598d7345218eaeb1c85e3ccfaf347c998b4fb83dd8cb08c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 11:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

obXClient.exe
Size

64KB
MD5

591e9953e62a79303811c9ca80191df9
SHA1

387c087dc56454635de1ee1a3ba9697d8709ad84
SHA256

19484f6840c4f4c21598d7345218eaeb1c85e3ccfaf347c998b4fb83dd8cb08c
SHA512

88b25f3b6421e2e9c9c48ce0a9d4303b25f8d9946a937fcae072d9b2e55b85a42f502acaa0d6d1700e42e93c063a67cf5bfb8589a3784a8f8c5c5858fe83883b
SSDEEP

1536:1BNwbm2OEanmWH79J0ZAFHQpvtbkbYNoTFW1XwO9Hno:1BNwbTkff0i4kbYKQXwO9no

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

139.180.188.91:7000

Attributes

Install_directory
%AppData%
install_file
data33561.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4832-1-0x0000000000680000-0x0000000000696000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\data33561.lnk	obXClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\data33561.lnk	obXClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4832	obXClient.exe

C:\Users\Admin\AppData\Local\Temp\obXClient.exe
"C:\Users\Admin\AppData\Local\Temp\obXClient.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
PID:4832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4832-0-0x00007FF8863E3000-0x00007FF8863E5000-memory.dmp

Filesize
8KB

Download
memory/4832-1-0x0000000000680000-0x0000000000696000-memory.dmp

Filesize
88KB

Download
memory/4832-6-0x00007FF8863E0000-0x00007FF886EA1000-memory.dmp

Filesize
10.8MB

Download
memory/4832-7-0x00007FF8863E3000-0x00007FF8863E5000-memory.dmp

Filesize
8KB

Download
memory/4832-8-0x00007FF8863E0000-0x00007FF886EA1000-memory.dmp

Filesize
10.8MB

Download