xworm | 2a4f91febd129b28db5ae9b789f302949064c7d4fcda4495f2398177882357f6

Analysis

max time kernel
126s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 17:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

XBinderOutput.exe
Size

8.1MB
MD5

4bc9bc389df0979f49ec0d4c451e58dd
SHA1

84f30c66573bd5e89c3d706a78ca01d9e64e384f
SHA256

2a4f91febd129b28db5ae9b789f302949064c7d4fcda4495f2398177882357f6
SHA512

0c92a8851657641d556e5f6f2674c85af105ce1a0634f2b0346fe309a49dae7f3f0a09c67ded8907dfd9cbf4551b7a89571f26b11f2a4e044857562b0e48029c
SSDEEP

196608:UrSeaQ9Jv5GB4BtI7BWtPjFvvCMC0JwiO3Sbo8b:UOPot5GB4ActbhvVqFoo8b

Score

10^/10

xworm execution persistence rat trojan upx

Malware Config

Extracted

Family

xworm

engine-romania.gl.at.ply.gg:37581

Attributes

Install_directory
%AppData%
install_file
discord.exe

Signatures

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral1/files/0x000e0000000054ab-13.dat	family_xworm
behavioral1/memory/2800-15-0x0000000000CF0000-0x0000000000D06000-memory.dmp	family_xworm
behavioral1/memory/2512-194-0x00000000012A0000-0x00000000012B6000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2504	powershell.exe
2036	powershell.exe
2248	powershell.exe
912	powershell.exe
1896	powershell.exe
2668	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.lnk	13456.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.lnk	13456.exe

Executes dropped EXE 6 IoCs

pid	Process
2800	13456.exe
2416	Built.exe
2200	Built.exe
1192	Process not Found
2512	discord.exe
1984	discord.exe

Loads dropped DLL 9 IoCs

pid	Process
3000	XBinderOutput.exe
2200	Built.exe
2200	Built.exe
2200	Built.exe
2200	Built.exe
2200	Built.exe
2200	Built.exe
2200	Built.exe
1192	Process not Found

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000016d5f-103.dat	upx
behavioral1/memory/2200-105-0x000007FEF2500000-0x000007FEF2AF2000-memory.dmp	upx

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\discord = "C:\\Users\\Admin\\AppData\\Roaming\\discord.exe"	13456.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\13456 = "C:\\Windows\\System32\\13456.exe"	XBinderOutput.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Built = "C:\\Windows\\System32\\Built.exe"	XBinderOutput.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\13456.exe	XBinderOutput.exe
File opened for modification	C:\Windows\System32\13456.exe	XBinderOutput.exe
File created	C:\Windows\System32\Built.exe	XBinderOutput.exe
File opened for modification	C:\Windows\System32\Built.exe	XBinderOutput.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1644	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2668	powershell.exe
2504	powershell.exe
2036	powershell.exe
2248	powershell.exe
912	powershell.exe
1896	powershell.exe
2800	13456.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeDebugPrivilege	2800	13456.exe
Token: SeDebugPrivilege	2504	powershell.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeDebugPrivilege	2248	powershell.exe
Token: SeDebugPrivilege	912	powershell.exe
Token: SeDebugPrivilege	1896	powershell.exe
Token: SeDebugPrivilege	2800	13456.exe
Token: SeDebugPrivilege	2512	discord.exe
Token: SeDebugPrivilege	1984	discord.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2800	13456.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2668	3000	XBinderOutput.exe	28
PID 3000 wrote to memory of 2668	3000	XBinderOutput.exe	28
PID 3000 wrote to memory of 2668	3000	XBinderOutput.exe	28
PID 3000 wrote to memory of 2800	3000	XBinderOutput.exe	30
PID 3000 wrote to memory of 2800	3000	XBinderOutput.exe	30
PID 3000 wrote to memory of 2800	3000	XBinderOutput.exe	30
PID 3000 wrote to memory of 2504	3000	XBinderOutput.exe	31
PID 3000 wrote to memory of 2504	3000	XBinderOutput.exe	31
PID 3000 wrote to memory of 2504	3000	XBinderOutput.exe	31
PID 3000 wrote to memory of 2416	3000	XBinderOutput.exe	33
PID 3000 wrote to memory of 2416	3000	XBinderOutput.exe	33
PID 3000 wrote to memory of 2416	3000	XBinderOutput.exe	33
PID 2416 wrote to memory of 2200	2416	Built.exe	34
PID 2416 wrote to memory of 2200	2416	Built.exe	34
PID 2416 wrote to memory of 2200	2416	Built.exe	34
PID 2800 wrote to memory of 2036	2800	13456.exe	36
PID 2800 wrote to memory of 2036	2800	13456.exe	36
PID 2800 wrote to memory of 2036	2800	13456.exe	36
PID 2800 wrote to memory of 2248	2800	13456.exe	38
PID 2800 wrote to memory of 2248	2800	13456.exe	38
PID 2800 wrote to memory of 2248	2800	13456.exe	38
PID 2800 wrote to memory of 912	2800	13456.exe	40
PID 2800 wrote to memory of 912	2800	13456.exe	40
PID 2800 wrote to memory of 912	2800	13456.exe	40
PID 2800 wrote to memory of 1896	2800	13456.exe	42
PID 2800 wrote to memory of 1896	2800	13456.exe	42
PID 2800 wrote to memory of 1896	2800	13456.exe	42
PID 2800 wrote to memory of 1644	2800	13456.exe	44
PID 2800 wrote to memory of 1644	2800	13456.exe	44
PID 2800 wrote to memory of 1644	2800	13456.exe	44
PID 2660 wrote to memory of 2512	2660	taskeng.exe	49
PID 2660 wrote to memory of 2512	2660	taskeng.exe	49
PID 2660 wrote to memory of 2512	2660	taskeng.exe	49
PID 2660 wrote to memory of 1984	2660	taskeng.exe	50
PID 2660 wrote to memory of 1984	2660	taskeng.exe	50
PID 2660 wrote to memory of 1984	2660	taskeng.exe	50

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XBinderOutput.exe
"C:\Users\Admin\AppData\Local\Temp\XBinderOutput.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\13456.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2668
- C:\Windows\System32\13456.exe
  "C:\Windows\System32\13456.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\13456.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '13456.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\discord.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'discord.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1896
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "discord" /tr "C:\Users\Admin\AppData\Roaming\discord.exe"
    3⤵
    - Creates scheduled task(s)
    PID:1644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Built.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2504
- C:\Windows\System32\Built.exe
  "C:\Windows\System32\Built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\System32\Built.exe
    "C:\Windows\System32\Built.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2200

C:\Windows\system32\taskeng.exe
taskeng.exe {E79D35B0-5685-424B-ADBC-8C9CDB6F6BA1} S-1-5-21-3452737119-3959686427-228443150-1000:QGTQZTRE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Users\Admin\AppData\Roaming\discord.exe
  C:\Users\Admin\AppData\Roaming\discord.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2512
- C:\Users\Admin\AppData\Roaming\discord.exe
  C:\Users\Admin\AppData\Roaming\discord.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI24162\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
bfffa7117fd9b1622c66d949bac3f1d7

SHA1
402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

SHA256
1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

SHA512
b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24162\python311.dll

Filesize
1.6MB

MD5
ccdbd8027f165575a66245f8e9d140de

SHA1
d91786422ce1f1ad35c528d1c4cd28b753a81550

SHA256
503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971

SHA512
870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24162\ucrtbase.dll

Filesize
992KB

MD5
0e0bac3d1dcc1833eae4e3e4cf83c4ef

SHA1
4189f4459c54e69c6d3155a82524bda7549a75a6

SHA256
8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

SHA512
a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1NKSNLTUVZMTQN1886ZO.temp

Filesize
7KB

MD5
2b77ad64bf150be32667761dd3bc1263

SHA1
a90cc5782faf5954666d0241b8dd5898bfdd31cf

SHA256
fb849f9069393d390651f16340804cd28b88385020b4efc5b68cace52775aff2

SHA512
fc8ead847be8649ce65877b7717d0263a9073b38b7d1aa9283bec9197fcb6af16dd0d7a5031b70a5fd2bbbf3067765d103f7f901e652a14a89093faa8a8fab77

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6852bab31d60585fab7e4575b1f96947

SHA1
dfd1bf58122892f8eadd0f6e720cdbf730e2e538

SHA256
58e94a58c27c5e42e0547ef04efc939016d72f71a47b03d439d718842e336076

SHA512
4ffe6d63e28fc074bb46a73ea3ddf3ecea12f5a02c683dc54c8fe370fa3931b205e4615a4de82c9b15b02da9d8ef87f4fe92a57c86676f16b8c485f3b88c65c2

Download Submit
C:\Windows\System32\13456.exe

Filesize
63KB

MD5
5ab1f0f9945d2b12e4e718265a3a9a05

SHA1
5cdf666f4714eafe0fdbe34f1ff0650b0c42ce98

SHA256
a24fe607795302ce4addfb89c8a326d2f510a488d6dcc4574d9b0a24c377c363

SHA512
6b55a8d820e5b7bdf25add885825f8a361c354fc6cdf306b91e27e2c909d8c0e1fd8e73e82dd146651dcad3de5dd7210bc6e81091d89510f957aebe5c7c068ed

Download Submit
C:\Windows\System32\Built.exe

Filesize
8.2MB

MD5
c2c689f596c8a210126739de0a466ecd

SHA1
9a1b4d6ff9c042381918db9083137ee7d8c3bda6

SHA256
29a0c8b89753932ea3a82eed542cfe8b94945082cdca3382813fa6b2838e2102

SHA512
09e67da66d6da57c57a1cc99ae0d19d96a45bc5c95aa063558a4345ae29e1aa39763d337b51dac94a3c70fca6f831a1300e4fdbbe45174e795963b346f9f8573

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI24162\api-ms-win-core-file-l1-2-0.dll

Filesize
21KB

MD5
1c58526d681efe507deb8f1935c75487

SHA1
0e6d328faf3563f2aae029bc5f2272fb7a742672

SHA256
ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2

SHA512
8edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI24162\api-ms-win-core-localization-l1-2-0.dll

Filesize
21KB

MD5
724223109e49cb01d61d63a8be926b8f

SHA1
072a4d01e01dbbab7281d9bd3add76f9a3c8b23b

SHA256
4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210

SHA512
19b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI24162\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
21KB

MD5
517eb9e2cb671ae49f99173d7f7ce43f

SHA1
4ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab

SHA256
57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54

SHA512
492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI24162\api-ms-win-core-timezone-l1-1-0.dll

Filesize
21KB

MD5
d12403ee11359259ba2b0706e5e5111c

SHA1
03cc7827a30fd1dee38665c0cc993b4b533ac138

SHA256
f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781

SHA512
9004f4e59835af57f02e8d9625814db56f0e4a98467041da6f1367ef32366ad96e0338d48fff7cc65839a24148e2d9989883bcddc329d9f4d27cae3f843117d0

Download Submit
memory/2036-113-0x0000000002170000-0x0000000002178000-memory.dmp

Filesize
32KB

Download
memory/2200-105-0x000007FEF2500000-0x000007FEF2AF2000-memory.dmp

Filesize
5.9MB

Download
memory/2248-120-0x0000000001E00000-0x0000000001E08000-memory.dmp

Filesize
32KB

Download
memory/2248-119-0x000000001B7F0000-0x000000001BAD2000-memory.dmp

Filesize
2.9MB

Download
memory/2504-21-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/2504-22-0x0000000001D90000-0x0000000001D98000-memory.dmp

Filesize
32KB

Download
memory/2512-194-0x00000000012A0000-0x00000000012B6000-memory.dmp

Filesize
88KB

Download
memory/2668-8-0x0000000002990000-0x0000000002998000-memory.dmp

Filesize
32KB

Download
memory/2668-6-0x0000000002CD0000-0x0000000002D50000-memory.dmp

Filesize
512KB

Download
memory/2668-7-0x000000001B570000-0x000000001B852000-memory.dmp

Filesize
2.9MB

Download
memory/2800-189-0x00000000022C0000-0x00000000022CC000-memory.dmp

Filesize
48KB

Download
memory/2800-15-0x0000000000CF0000-0x0000000000D06000-memory.dmp

Filesize
88KB

Download
memory/3000-0-0x000007FEF5A73000-0x000007FEF5A74000-memory.dmp

Filesize
4KB

Download
memory/3000-1-0x0000000001280000-0x0000000001A98000-memory.dmp

Filesize
8.1MB

Download