xworm | 5fb96191ad7394700966c0854e3f1225b8b2989f528ce6993a747ff7a9cf2552

Resubmissions

08/05/2024, 18:11

240508-wsqkwage4w 10

08/05/2024, 18:07

240508-wqltxaah47 10

Analysis

max time kernel
121s
max time network
148s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 18:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XClient.exe
Size

67KB
MD5

c9cd80d55733208fc06b8b52cddb52dc
SHA1

6cc60302d90e7d7661b5b194fa954efacba19d49
SHA256

5fb96191ad7394700966c0854e3f1225b8b2989f528ce6993a747ff7a9cf2552
SHA512

befca56bfce924e50c11f9d702ab2d6a6e05d55cd4399c4ac37891c1d337a43d05060f5cb9a1600fc4c172f7816fad14bc02e0c8d44eb82b55f61da4812cd0aa
SSDEEP

1536:n5ydgkcoaOOTxMH/W0WybZYgmH2r2i6urYiZOenvefZ3:FVxMfwybZ4rYXZOewZ3

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

silver-bowl.gl.at.ply.gg:29206

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2244-1-0x0000000000D50000-0x0000000000D68000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2860	powershell.exe
2704	powershell.exe
2788	powershell.exe
2564	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe

Loads dropped DLL 1 IoCs

pid	Process
2244	XClient.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2860	powershell.exe
2704	powershell.exe
2788	powershell.exe
2564	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2244	XClient.exe
Token: SeDebugPrivilege	2860	powershell.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	2788	powershell.exe
Token: SeDebugPrivilege	2564	powershell.exe
Token: SeDebugPrivilege	2244	XClient.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2860	2244	XClient.exe	29
PID 2244 wrote to memory of 2860	2244	XClient.exe	29
PID 2244 wrote to memory of 2860	2244	XClient.exe	29
PID 2244 wrote to memory of 2704	2244	XClient.exe	31
PID 2244 wrote to memory of 2704	2244	XClient.exe	31
PID 2244 wrote to memory of 2704	2244	XClient.exe	31
PID 2244 wrote to memory of 2788	2244	XClient.exe	33
PID 2244 wrote to memory of 2788	2244	XClient.exe	33
PID 2244 wrote to memory of 2788	2244	XClient.exe	33
PID 2244 wrote to memory of 2564	2244	XClient.exe	35
PID 2244 wrote to memory of 2564	2244	XClient.exe	35
PID 2244 wrote to memory of 2564	2244	XClient.exe	35

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
10d7ddaafb43872471f74067df8e48b0

SHA1
e17566b2fab56a095f6aec3fa7e5927d856e8d15

SHA256
33091a778904203277bc82f7428fa1cff3749dd0cea4bacc31edd9fda98e1af6

SHA512
ac74a2fe86705b0c6ca01eefb48a89129c1d1d97ae88c14f5a9c93a5c181cf2eee8f0c7b897fafc278cb2b05900b298cdd86993c499a089b9bdae05e778805b8

Download Submit
\Users\Admin\AppData\Local\Temp\tmp9C8D.tmp

Filesize
100KB

MD5
1b942faa8e8b1008a8c3c1004ba57349

SHA1
cd99977f6c1819b12b33240b784ca816dfe2cb91

SHA256
555ccb7ecd9ae52a75135fdd81ab443a49d5785b0621ed6468d28c4234e46ccc

SHA512
5aee3d59478d41ddd5885c99b394c9c4983064e2b3528db1a3f7fc289662bced4f57d072517bbe7573c6d1789435e987ef1aa9cc91f372bcfd30bc016675fa43

Download Submit
memory/2244-31-0x000007FEF4E43000-0x000007FEF4E44000-memory.dmp

Filesize
4KB

Download
memory/2244-1-0x0000000000D50000-0x0000000000D68000-memory.dmp

Filesize
96KB

Download
memory/2244-2-0x000007FEF4E40000-0x000007FEF582C000-memory.dmp

Filesize
9.9MB

Download
memory/2244-33-0x0000000002170000-0x00000000021AA000-memory.dmp

Filesize
232KB

Download
memory/2244-0-0x000007FEF4E43000-0x000007FEF4E44000-memory.dmp

Filesize
4KB

Download
memory/2244-32-0x000007FEF4E40000-0x000007FEF582C000-memory.dmp

Filesize
9.9MB

Download
memory/2704-14-0x000000001B3F0000-0x000000001B6D2000-memory.dmp

Filesize
2.9MB

Download
memory/2704-15-0x0000000002C70000-0x0000000002C78000-memory.dmp

Filesize
32KB

Download
memory/2860-8-0x0000000002960000-0x0000000002968000-memory.dmp

Filesize
32KB

Download
memory/2860-7-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download