xworm | 118d236485ff8b58d7ab372d55f083fa7b6db08ad0a3655d4e1d871d76c9d2dd

General

Target

XClient.exe
Size

39KB
MD5

e714edb3f5402f430bdab1cca71a4715
SHA1

743d06c2fe1a13838e37ad345e8a23507a162c7f
SHA256

118d236485ff8b58d7ab372d55f083fa7b6db08ad0a3655d4e1d871d76c9d2dd
SHA512

89b93fd141fd2703bbc60831f6b16161050bd1ef56f805c71fb22b2a3c1446694333cbb8389d747c72f67606724c17746734e063d10e97bb123af87aca6940e0
SSDEEP

768:xG7+qmT8ztyh6pwDYvCL2v6hCuuJf27j1fFWPG9/p6OOwh5jObH:cfmT8ztyh6pwDnKwCuuJf4Fv9/p6OOwo

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

19.ip.gl.ply.gg:49487

Mutex

oMmNpHSdiI3wJln5

Attributes

Install_directory
%AppData%
install_file
XClient.exe

aes.plain

Signatures

Detect Xworm Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1640-1-0x00000000011E0000-0x00000000011F0000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Roaming\XClient.exe	family_xworm
behavioral1/memory/1444-43-0x0000000001260000-0x0000000001270000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

1612 powershell.exe
2112 powershell.exe
2684 powershell.exe
1984 powershell.exe

pid	process
1612	powershell.exe
2112	powershell.exe
2684	powershell.exe
1984	powershell.exe

Drops startup file 2 IoCs

Processes:

XClient.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe

Executes dropped EXE 2 IoCs

Processes:

XClient.exeXClient.exe

pid process

1444 XClient.exe
1088 XClient.exe
Loads dropped DLL 2 IoCs

Processes:

XClient.exe

pid process

1640 XClient.exe
1640 XClient.exe

pid	process
1444	XClient.exe
1088	XClient.exe

pid	process
1640	XClient.exe
1640	XClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

XClient.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	XClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3068 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeXClient.exe

pid process

1612 powershell.exe
2112 powershell.exe
2684 powershell.exe
1984 powershell.exe
1640 XClient.exe

pid	process
3068	schtasks.exe

pid	process
1612	powershell.exe
2112	powershell.exe
2684	powershell.exe
1984	powershell.exe
1640	XClient.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

XClient.exepowershell.exepowershell.exepowershell.exepowershell.exeXClient.exeXClient.exe

description	pid	process
Token: SeDebugPrivilege	1640	XClient.exe
Token: SeDebugPrivilege	1612	powershell.exe
Token: SeDebugPrivilege	2112	powershell.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeDebugPrivilege	1984	powershell.exe
Token: SeDebugPrivilege	1640	XClient.exe
Token: SeDebugPrivilege	1444	XClient.exe
Token: SeDebugPrivilege	1088	XClient.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

XClient.exe

pid process

1640 XClient.exe

pid	process
1640	XClient.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

XClient.exetaskeng.exe

description	pid	process	target process
PID 1640 wrote to memory of 1612	1640	XClient.exe	powershell.exe
PID 1640 wrote to memory of 1612	1640	XClient.exe	powershell.exe
PID 1640 wrote to memory of 1612	1640	XClient.exe	powershell.exe
PID 1640 wrote to memory of 2112	1640	XClient.exe	powershell.exe
PID 1640 wrote to memory of 2112	1640	XClient.exe	powershell.exe
PID 1640 wrote to memory of 2112	1640	XClient.exe	powershell.exe
PID 1640 wrote to memory of 2684	1640	XClient.exe	powershell.exe
PID 1640 wrote to memory of 2684	1640	XClient.exe	powershell.exe
PID 1640 wrote to memory of 2684	1640	XClient.exe	powershell.exe
PID 1640 wrote to memory of 1984	1640	XClient.exe	powershell.exe
PID 1640 wrote to memory of 1984	1640	XClient.exe	powershell.exe
PID 1640 wrote to memory of 1984	1640	XClient.exe	powershell.exe
PID 1640 wrote to memory of 3068	1640	XClient.exe	schtasks.exe
PID 1640 wrote to memory of 3068	1640	XClient.exe	schtasks.exe
PID 1640 wrote to memory of 3068	1640	XClient.exe	schtasks.exe
PID 572 wrote to memory of 1444	572	taskeng.exe	XClient.exe
PID 572 wrote to memory of 1444	572	taskeng.exe	XClient.exe
PID 572 wrote to memory of 1444	572	taskeng.exe	XClient.exe
PID 572 wrote to memory of 1088	572	taskeng.exe	XClient.exe
PID 572 wrote to memory of 1088	572	taskeng.exe	XClient.exe
PID 572 wrote to memory of 1088	572	taskeng.exe	XClient.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1612

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2112

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2684

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1984

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
2⤵
- Creates scheduled task(s)
PID:3068

C:\Windows\system32\taskeng.exe
taskeng.exe {A70320E9-7978-4C1B-A433-1F8068F804AA} S-1-5-21-481678230-3773327859-3495911762-1000:UIBNQNMA\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:572

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1444

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
3d4ec81efcee9a529d8c4ee24b50ac15

SHA1
16f152593200005ed15a2cc1cbd221d0f53adb57

SHA256
165c1caf92d32c48ae95fa24e2267ca3f3649d6c72a036c5ed172941d0ad1f56

SHA512
3fe895482aa1f9a0c30316fd5819ce06453982767e4e844bc68781e0bf50c6d622800b5000e6457399ced4660c2b3777120d91938e7efa8faa3664257ed6a28e

Download Submit
C:\Users\Admin\AppData\Roaming\XClient.exe
Filesize
39KB

MD5
e714edb3f5402f430bdab1cca71a4715

SHA1
743d06c2fe1a13838e37ad345e8a23507a162c7f

SHA256
118d236485ff8b58d7ab372d55f083fa7b6db08ad0a3655d4e1d871d76c9d2dd

SHA512
89b93fd141fd2703bbc60831f6b16161050bd1ef56f805c71fb22b2a3c1446694333cbb8389d747c72f67606724c17746734e063d10e97bb123af87aca6940e0

Download Submit
\Users\Admin\AppData\Local\Temp\tmp9BA3.tmp
Filesize
100KB

MD5
1b942faa8e8b1008a8c3c1004ba57349

SHA1
cd99977f6c1819b12b33240b784ca816dfe2cb91

SHA256
555ccb7ecd9ae52a75135fdd81ab443a49d5785b0621ed6468d28c4234e46ccc

SHA512
5aee3d59478d41ddd5885c99b394c9c4983064e2b3528db1a3f7fc289662bced4f57d072517bbe7573c6d1789435e987ef1aa9cc91f372bcfd30bc016675fa43

Download Submit
memory/1444-43-0x0000000001260000-0x0000000001270000-memory.dmp

Filesize
64KB

Download
memory/1612-6-0x0000000002C00000-0x0000000002C80000-memory.dmp

Filesize
512KB

Download
memory/1612-7-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/1612-8-0x0000000002890000-0x0000000002898000-memory.dmp

Filesize
32KB

Download
memory/1640-30-0x000000001B330000-0x000000001B3B0000-memory.dmp

Filesize
512KB

Download
memory/1640-0-0x000007FEF5533000-0x000007FEF5534000-memory.dmp

Filesize
4KB

Download
memory/1640-31-0x00000000004F0000-0x00000000004FC000-memory.dmp

Filesize
48KB

Download
memory/1640-32-0x000007FEF5533000-0x000007FEF5534000-memory.dmp

Filesize
4KB

Download
memory/1640-33-0x000000001B330000-0x000000001B3B0000-memory.dmp

Filesize
512KB

Download
memory/1640-34-0x000000001AC40000-0x000000001AC7A000-memory.dmp

Filesize
232KB

Download
memory/1640-39-0x000000001AE10000-0x000000001AE1A000-memory.dmp

Filesize
40KB

Download
memory/1640-1-0x00000000011E0000-0x00000000011F0000-memory.dmp

Filesize
64KB

Download
memory/2112-15-0x0000000002960000-0x0000000002968000-memory.dmp

Filesize
32KB

Download
memory/2112-14-0x000000001B6B0000-0x000000001B992000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads