xworm | 1e834e6461c9ed8b5b96aeff4ee6c088d492b801809c11bd4374ba769a94641e

General

Target

XClient.exe
Size

45KB
MD5

77abcd7184817e72756a90f127af277e
SHA1

0b6555207bc3ef2725352ba3f02ea611a0b4b1e0
SHA256

1e834e6461c9ed8b5b96aeff4ee6c088d492b801809c11bd4374ba769a94641e
SHA512

66e9fda6f0f1969e2ca6f99d9615cf7285e8dd96fe75dc989d07562f90c908a660643182150011844068f0c42d7eaabab77c00dc75e6136b40e6bd4996d5eb6a
SSDEEP

768:VU0MGoO7862I0BXMqpgbgBn7lGAmFEPG9nPK6vOCh5z9is3:VU0MzK8QWb7kF19PK6vOCDAs3

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

NsAiQ5KfVxBeGVWT

Attributes

Install_directory
%ProgramData%
install_file
Calculator.exe
pastebin_url
https://pastebin.com/raw/WrxExzm8

aes.plain

Signatures

Detect Xworm Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2648-1-0x00000000000D0000-0x00000000000E2000-memory.dmp	family_xworm
C:\ProgramData\Calculator.exe	family_xworm
behavioral1/memory/1940-35-0x00000000001B0000-0x00000000001C2000-memory.dmp	family_xworm
behavioral1/memory/2084-38-0x0000000000DA0000-0x0000000000DB2000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

2592 powershell.exe
2376 powershell.exe
2160 powershell.exe
2560 powershell.exe

pid	process
2592	powershell.exe
2376	powershell.exe
2160	powershell.exe
2560	powershell.exe

Drops startup file 2 IoCs

Processes:

XClient.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Calculator.lnk	XClient.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Calculator.lnk	XClient.exe

Executes dropped EXE 2 IoCs

Processes:

Calculator.exeCalculator.exe

pid process

1940 Calculator.exe
2084 Calculator.exe

pid	process
1940	Calculator.exe
2084	Calculator.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

XClient.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Calculator = "C:\\ProgramData\\Calculator.exe"	XClient.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

6 pastebin.com
7 pastebin.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1648 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeXClient.exe

pid process

2560 powershell.exe
2592 powershell.exe
2376 powershell.exe
2160 powershell.exe
2648 XClient.exe

flow	ioc
6	pastebin.com
7	pastebin.com

flow	ioc
4	ip-api.com

pid	process
1648	schtasks.exe

pid	process
2560	powershell.exe
2592	powershell.exe
2376	powershell.exe
2160	powershell.exe
2648	XClient.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

XClient.exepowershell.exepowershell.exepowershell.exepowershell.exeCalculator.exeCalculator.exe

description	pid	process
Token: SeDebugPrivilege	2648	XClient.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeDebugPrivilege	2592	powershell.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeDebugPrivilege	2648	XClient.exe
Token: SeDebugPrivilege	1940	Calculator.exe
Token: SeDebugPrivilege	2084	Calculator.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

XClient.exe

pid process

2648 XClient.exe

pid	process
2648	XClient.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

XClient.exetaskeng.exe

description	pid	process	target process
PID 2648 wrote to memory of 2560	2648	XClient.exe	powershell.exe
PID 2648 wrote to memory of 2560	2648	XClient.exe	powershell.exe
PID 2648 wrote to memory of 2560	2648	XClient.exe	powershell.exe
PID 2648 wrote to memory of 2592	2648	XClient.exe	powershell.exe
PID 2648 wrote to memory of 2592	2648	XClient.exe	powershell.exe
PID 2648 wrote to memory of 2592	2648	XClient.exe	powershell.exe
PID 2648 wrote to memory of 2376	2648	XClient.exe	powershell.exe
PID 2648 wrote to memory of 2376	2648	XClient.exe	powershell.exe
PID 2648 wrote to memory of 2376	2648	XClient.exe	powershell.exe
PID 2648 wrote to memory of 2160	2648	XClient.exe	powershell.exe
PID 2648 wrote to memory of 2160	2648	XClient.exe	powershell.exe
PID 2648 wrote to memory of 2160	2648	XClient.exe	powershell.exe
PID 2648 wrote to memory of 1648	2648	XClient.exe	schtasks.exe
PID 2648 wrote to memory of 1648	2648	XClient.exe	schtasks.exe
PID 2648 wrote to memory of 1648	2648	XClient.exe	schtasks.exe
PID 1708 wrote to memory of 1940	1708	taskeng.exe	Calculator.exe
PID 1708 wrote to memory of 1940	1708	taskeng.exe	Calculator.exe
PID 1708 wrote to memory of 1940	1708	taskeng.exe	Calculator.exe
PID 1708 wrote to memory of 2084	1708	taskeng.exe	Calculator.exe
PID 1708 wrote to memory of 2084	1708	taskeng.exe	Calculator.exe
PID 1708 wrote to memory of 2084	1708	taskeng.exe	Calculator.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2560

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2592

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Calculator.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2376

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Calculator.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2160

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Calculator" /tr "C:\ProgramData\Calculator.exe"
2⤵
- Creates scheduled task(s)
PID:1648

C:\Windows\system32\taskeng.exe
taskeng.exe {FCF37F7B-598B-4F70-961D-3D16333BA69B} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1708

C:\ProgramData\Calculator.exe
C:\ProgramData\Calculator.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1940

C:\ProgramData\Calculator.exe
C:\ProgramData\Calculator.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Calculator.exe

Filesize
45KB

MD5
77abcd7184817e72756a90f127af277e

SHA1
0b6555207bc3ef2725352ba3f02ea611a0b4b1e0

SHA256
1e834e6461c9ed8b5b96aeff4ee6c088d492b801809c11bd4374ba769a94641e

SHA512
66e9fda6f0f1969e2ca6f99d9615cf7285e8dd96fe75dc989d07562f90c908a660643182150011844068f0c42d7eaabab77c00dc75e6136b40e6bd4996d5eb6a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
5765bd5ec67f244b173016b9a5dc9184

SHA1
3d5a3939bb214c7e5aaf01d395e3e1ae6fa6a852

SHA256
3a778cfd374d7789c7a888f6ab68bd45f18697a0d9f29a15606205832b839eaf

SHA512
6bc146dc4c9f4e35c701bf4e703585fbb9bae4143ddb2b20babbc32f24a6c344de495af1e4849eacb47cdb3cf126dc266e5e61e5c064e4941bcf513c1eb6ad82

Download Submit
memory/1940-35-0x00000000001B0000-0x00000000001C2000-memory.dmp

Filesize
72KB

Download
memory/2084-38-0x0000000000DA0000-0x0000000000DB2000-memory.dmp

Filesize
72KB

Download
memory/2560-7-0x000000001B320000-0x000000001B602000-memory.dmp

Filesize
2.9MB

Download
memory/2560-8-0x0000000002390000-0x0000000002398000-memory.dmp

Filesize
32KB

Download
memory/2592-14-0x000000001B200000-0x000000001B4E2000-memory.dmp

Filesize
2.9MB

Download
memory/2592-15-0x0000000002310000-0x0000000002318000-memory.dmp

Filesize
32KB

Download
memory/2648-30-0x000007FEF5A73000-0x000007FEF5A74000-memory.dmp

Filesize
4KB

Download
memory/2648-31-0x000007FEF5A70000-0x000007FEF645C000-memory.dmp

Filesize
9.9MB

Download
memory/2648-0-0x000007FEF5A73000-0x000007FEF5A74000-memory.dmp

Filesize
4KB

Download
memory/2648-2-0x000007FEF5A70000-0x000007FEF645C000-memory.dmp

Filesize
9.9MB

Download
memory/2648-1-0x00000000000D0000-0x00000000000E2000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads