xworm | 8c42fe788c73dfe7843feb5e6ec639a9f0cdfc1a4dc3e6536242f23636c870b9

General

Target

EZChanger.exe
Size

427KB
MD5

b54849e4f68488b99339341a80d6b02a
SHA1

73ae2db4a12abb7a68ad410f31a878eb2a87a2fb
SHA256

8c42fe788c73dfe7843feb5e6ec639a9f0cdfc1a4dc3e6536242f23636c870b9
SHA512

de7bd9e4682b62d46c5ef95a204d880c55000674075b5d55ce631874af590ade052548d933742f364b6abcb10726e3ade53bd3d1b1234bec9559531c5a0e1602
SSDEEP

6144:XT1+bqO3XnmtWrnngnnnKnanlywwwBwwA5wwwwswww+wwwGwwwbwwwLwwwwwwwwg:DFO3WtWrnngnnnKnanxNY

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:37915

5.39.43.50:37915

de-engines.gl.at.ply.gg:37915

these-accommodation.gl.at.ply.gg:37915

Attributes

Install_directory
%AppData%
install_file
dllhost.exe

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3044-1-0x0000000000370000-0x00000000003E0000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

2720 powershell.exe
2604 powershell.exe
2396 powershell.exe
2308 powershell.exe

pid	process
2720	powershell.exe
2604	powershell.exe
2396	powershell.exe
2308	powershell.exe

Drops startup file 2 IoCs

Processes:

EZChanger.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dllhost.lnk	EZChanger.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dllhost.lnk	EZChanger.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

EZChanger.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Roaming\\dllhost.exe"	EZChanger.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeEZChanger.exe

pid process

2720 powershell.exe
2604 powershell.exe
2396 powershell.exe
2308 powershell.exe
3044 EZChanger.exe

flow	ioc
2	ip-api.com

pid	process
2720	powershell.exe
2604	powershell.exe
2396	powershell.exe
2308	powershell.exe
3044	EZChanger.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

EZChanger.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	3044	EZChanger.exe
Token: SeDebugPrivilege	2720	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	2396	powershell.exe
Token: SeDebugPrivilege	2308	powershell.exe
Token: SeDebugPrivilege	3044	EZChanger.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

EZChanger.exe

pid process

3044 EZChanger.exe

pid	process
3044	EZChanger.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

EZChanger.exe

description	pid	process	target process
PID 3044 wrote to memory of 2720	3044	EZChanger.exe	powershell.exe
PID 3044 wrote to memory of 2720	3044	EZChanger.exe	powershell.exe
PID 3044 wrote to memory of 2720	3044	EZChanger.exe	powershell.exe
PID 3044 wrote to memory of 2604	3044	EZChanger.exe	powershell.exe
PID 3044 wrote to memory of 2604	3044	EZChanger.exe	powershell.exe
PID 3044 wrote to memory of 2604	3044	EZChanger.exe	powershell.exe
PID 3044 wrote to memory of 2396	3044	EZChanger.exe	powershell.exe
PID 3044 wrote to memory of 2396	3044	EZChanger.exe	powershell.exe
PID 3044 wrote to memory of 2396	3044	EZChanger.exe	powershell.exe
PID 3044 wrote to memory of 2308	3044	EZChanger.exe	powershell.exe
PID 3044 wrote to memory of 2308	3044	EZChanger.exe	powershell.exe
PID 3044 wrote to memory of 2308	3044	EZChanger.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\EZChanger.exe
"C:\Users\Admin\AppData\Local\Temp\EZChanger.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\EZChanger.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2720

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'EZChanger.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2604

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\dllhost.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2396

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'dllhost.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GA06ZEA6JFVTNIXLV15N.temp

Filesize
7KB

MD5
a948434285617305e6dd3d9648039bf7

SHA1
f30e2b5def853dd727f265b8e8d31346725f1ad9

SHA256
77126a76ce2540a898661a7c8d747d6e3fc14c069b957a064bac5414a86760cf

SHA512
6df76da05c8105d1ef022e4b9a2ef418cf4466f12db92a6c481b130a06eb604ad1f3d3a2aaff89cc72c46c3dbdb559cadb359d728a54d505c557a17b2f907022

Download Submit
memory/2604-14-0x000000001B600000-0x000000001B8E2000-memory.dmp

Filesize
2.9MB

Download
memory/2604-15-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2720-7-0x000000001B790000-0x000000001BA72000-memory.dmp

Filesize
2.9MB

Download
memory/2720-8-0x0000000001EC0000-0x0000000001EC8000-memory.dmp

Filesize
32KB

Download
memory/3044-0-0x000007FEF5753000-0x000007FEF5754000-memory.dmp

Filesize
4KB

Download
memory/3044-1-0x0000000000370000-0x00000000003E0000-memory.dmp

Filesize
448KB

Download
memory/3044-2-0x000007FEF5750000-0x000007FEF613C000-memory.dmp

Filesize
9.9MB

Download
memory/3044-30-0x000007FEF5753000-0x000007FEF5754000-memory.dmp

Filesize
4KB

Download
memory/3044-31-0x000007FEF5750000-0x000007FEF613C000-memory.dmp

Filesize
9.9MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads