xworm | aa83740e4e4300a89a86b14491f3a567ba4ed498b016855fa21871795029ff8d

General

Target

XClient.exe
Size

81KB
MD5

c6ffac22c66a74b54db0b68ee74f89f8
SHA1

b92762dcc83f5c1fc93930f9319ed7817ee3358d
SHA256

aa83740e4e4300a89a86b14491f3a567ba4ed498b016855fa21871795029ff8d
SHA512

50aa41fd3da84cb488cb697f72013106ff98035fe1d78f293bde59e296d06c3456c8979fb335f6d760081a4850d6c4b70de0ba543391a9e636be43561a46cca2
SSDEEP

1536:c3xKcyVhF1H97YBpb1/KkH9VlGxGZ5d6qKA2jOSKfd2l:c3xolHxoblKkHJGxqd32jOSKf0

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

values-painted.gl.at.ply.gg:12784

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

Detect Xworm Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2868-1-0x00000000008D0000-0x00000000008EA000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Roaming\XClient.exe	family_xworm
behavioral1/memory/888-32-0x0000000001230000-0x000000000124A000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

1952 powershell.exe
2596 powershell.exe
2760 powershell.exe
2488 powershell.exe
Executes dropped EXE 3 IoCs

Processes:

XClient.exeXClient.exeXClient.exe

pid process

888 XClient.exe
772 XClient.exe
2968 XClient.exe

pid	process
1952	powershell.exe
2596	powershell.exe
2760	powershell.exe
2488	powershell.exe

pid	process
888	XClient.exe
772	XClient.exe
2968	XClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

XClient.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	XClient.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3040 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeXClient.exe

pid process

2596 powershell.exe
2760 powershell.exe
2488 powershell.exe
1952 powershell.exe
2868 XClient.exe

flow	ioc
4	ip-api.com

pid	process
3040	schtasks.exe

pid	process
2596	powershell.exe
2760	powershell.exe
2488	powershell.exe
1952	powershell.exe
2868	XClient.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

XClient.exepowershell.exepowershell.exepowershell.exepowershell.exeXClient.exeXClient.exeXClient.exe

description	pid	process
Token: SeDebugPrivilege	2868	XClient.exe
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeDebugPrivilege	2488	powershell.exe
Token: SeDebugPrivilege	1952	powershell.exe
Token: SeDebugPrivilege	2868	XClient.exe
Token: SeDebugPrivilege	888	XClient.exe
Token: SeDebugPrivilege	772	XClient.exe
Token: SeDebugPrivilege	2968	XClient.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

XClient.exe

pid process

2868 XClient.exe

pid	process
2868	XClient.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

XClient.exetaskeng.exe

description	pid	process	target process
PID 2868 wrote to memory of 2596	2868	XClient.exe	powershell.exe
PID 2868 wrote to memory of 2596	2868	XClient.exe	powershell.exe
PID 2868 wrote to memory of 2596	2868	XClient.exe	powershell.exe
PID 2868 wrote to memory of 2760	2868	XClient.exe	powershell.exe
PID 2868 wrote to memory of 2760	2868	XClient.exe	powershell.exe
PID 2868 wrote to memory of 2760	2868	XClient.exe	powershell.exe
PID 2868 wrote to memory of 2488	2868	XClient.exe	powershell.exe
PID 2868 wrote to memory of 2488	2868	XClient.exe	powershell.exe
PID 2868 wrote to memory of 2488	2868	XClient.exe	powershell.exe
PID 2868 wrote to memory of 1952	2868	XClient.exe	powershell.exe
PID 2868 wrote to memory of 1952	2868	XClient.exe	powershell.exe
PID 2868 wrote to memory of 1952	2868	XClient.exe	powershell.exe
PID 2868 wrote to memory of 3040	2868	XClient.exe	schtasks.exe
PID 2868 wrote to memory of 3040	2868	XClient.exe	schtasks.exe
PID 2868 wrote to memory of 3040	2868	XClient.exe	schtasks.exe
PID 1444 wrote to memory of 888	1444	taskeng.exe	XClient.exe
PID 1444 wrote to memory of 888	1444	taskeng.exe	XClient.exe
PID 1444 wrote to memory of 888	1444	taskeng.exe	XClient.exe
PID 1444 wrote to memory of 772	1444	taskeng.exe	XClient.exe
PID 1444 wrote to memory of 772	1444	taskeng.exe	XClient.exe
PID 1444 wrote to memory of 772	1444	taskeng.exe	XClient.exe
PID 1444 wrote to memory of 2968	1444	taskeng.exe	XClient.exe
PID 1444 wrote to memory of 2968	1444	taskeng.exe	XClient.exe
PID 1444 wrote to memory of 2968	1444	taskeng.exe	XClient.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2596

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2760

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2488

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1952

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
2⤵
- Creates scheduled task(s)
PID:3040

C:\Windows\system32\taskeng.exe
taskeng.exe {5790D0B9-098A-420C-B2EF-D319E51570E7} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1444

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:888

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:772

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
ca3f2b6531d843c9c54868d2e7be8c09

SHA1
92d8666ea55ea8c21e95b5c1e74817b2d9cf9e14

SHA256
2a787e2f49271b31dbbc01356b49cc7005dccb7ae2269b928f7828274b11cef6

SHA512
acab23d571ec24806001c34e4e6fc83d9c9d29f32f1ba7a6223567998a0b218983d1c91ddac2b25fd576102eac84bd5a185c38f164d12c8f3f7e9aa3108c5c2c

Download Submit
C:\Users\Admin\AppData\Roaming\XClient.exe

Filesize
81KB

MD5
c6ffac22c66a74b54db0b68ee74f89f8

SHA1
b92762dcc83f5c1fc93930f9319ed7817ee3358d

SHA256
aa83740e4e4300a89a86b14491f3a567ba4ed498b016855fa21871795029ff8d

SHA512
50aa41fd3da84cb488cb697f72013106ff98035fe1d78f293bde59e296d06c3456c8979fb335f6d760081a4850d6c4b70de0ba543391a9e636be43561a46cca2

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/888-32-0x0000000001230000-0x000000000124A000-memory.dmp

Filesize
104KB

Download
memory/2596-7-0x0000000002D90000-0x0000000002E10000-memory.dmp

Filesize
512KB

Download
memory/2596-8-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/2596-9-0x0000000001DD0000-0x0000000001DD8000-memory.dmp

Filesize
32KB

Download
memory/2760-15-0x000000001B5A0000-0x000000001B882000-memory.dmp

Filesize
2.9MB

Download
memory/2760-16-0x0000000001EA0000-0x0000000001EA8000-memory.dmp

Filesize
32KB

Download
memory/2868-2-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/2868-0-0x000007FEF57C3000-0x000007FEF57C4000-memory.dmp

Filesize
4KB

Download
memory/2868-1-0x00000000008D0000-0x00000000008EA000-memory.dmp

Filesize
104KB

Download
memory/2868-33-0x0000000002270000-0x000000000227C000-memory.dmp

Filesize
48KB

Download
memory/2868-34-0x000007FEF57C3000-0x000007FEF57C4000-memory.dmp

Filesize
4KB

Download
memory/2868-35-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads