xworm | 4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf

General

Target

4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe
Size

560KB
MD5

4a5f7263d5e978024e4d3c7abed82307
SHA1

0a8f9bb8e9058beb4bd67ea08b8ef82bc90fcd8c
SHA256

4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf
SHA512

d843fe704beeb3b61916c789626bc908eed44455a34a86a65994db47c759311aef05c4f2d1530f2f073e99e6bdf3dc2b15944772fee7d161b492e70ba8a09c22
SSDEEP

12288:IzxKn6yWn7fcpVZlu/6uHqa9XnWsh9P5u7JwdprNLUgNYGutA:rn698VVYFlRu7J6ZUgNiA

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

C2

104.250.180.178:7061

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3064-11-0x0000000000400000-0x0000000000414000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3064-11-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

3620 powershell.exe
3728 powershell.exe
4300 powershell.exe
4560 powershell.exe

pid	process
3620	powershell.exe
3728	powershell.exe
4300	powershell.exe
4560	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe

Drops startup file 2 IoCs

Processes:

4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe

description	pid	process	target process
PID 2316 set thread context of 3064	2316	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe

pid	process
4560	powershell.exe
4560	powershell.exe
3620	powershell.exe
3620	powershell.exe
3728	powershell.exe
3728	powershell.exe
4300	powershell.exe
4300	powershell.exe
3064	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	3064	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe
Token: SeDebugPrivilege	4560	powershell.exe
Token: SeDebugPrivilege	3620	powershell.exe
Token: SeDebugPrivilege	3728	powershell.exe
Token: SeDebugPrivilege	4300	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe

pid process

3064 4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe

pid	process
3064	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe

description	pid	process	target process
PID 2316 wrote to memory of 3064	2316	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe
PID 2316 wrote to memory of 3064	2316	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe
PID 2316 wrote to memory of 3064	2316	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe
PID 2316 wrote to memory of 3064	2316	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe
PID 2316 wrote to memory of 3064	2316	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe
PID 2316 wrote to memory of 3064	2316	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe
PID 2316 wrote to memory of 3064	2316	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe
PID 2316 wrote to memory of 3064	2316	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe
PID 3064 wrote to memory of 4560	3064	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe	powershell.exe
PID 3064 wrote to memory of 4560	3064	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe	powershell.exe
PID 3064 wrote to memory of 4560	3064	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe	powershell.exe
PID 3064 wrote to memory of 3620	3064	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe	powershell.exe
PID 3064 wrote to memory of 3620	3064	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe	powershell.exe
PID 3064 wrote to memory of 3620	3064	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe	powershell.exe
PID 3064 wrote to memory of 3728	3064	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe	powershell.exe
PID 3064 wrote to memory of 3728	3064	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe	powershell.exe
PID 3064 wrote to memory of 3728	3064	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe	powershell.exe
PID 3064 wrote to memory of 4300	3064	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe	powershell.exe
PID 3064 wrote to memory of 4300	3064	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe	powershell.exe
PID 3064 wrote to memory of 4300	3064	4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe
"C:\Users\Admin\AppData\Local\Temp\4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2316

C:\Users\Admin\AppData\Local\Temp\4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe
"C:\Users\Admin\AppData\Local\Temp\4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe"
2⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4560

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3620

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3728

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\4fb48e8fd54c7dba1422489d3312e5c0bde0f8e4d375103c28160403624afabf.exe.log
Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
781f02d34454bbfb0cd82357627fbe65

SHA1
23e173a3e99b489f177bc389c19b50320ddcef8c

SHA256
61777fe570a35d47e51d568dbc050c29fd09a8fbef9af032fcd2b2a82a8bba4c

SHA512
35ac27f0377b7f30000ec2518e395c38761d6809fd209c1ea8ff78995eb8a3f7b56e7a6dfe9d274b75eba78241363aad7a714506d396118a8238b6b9dd8b6db2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
61b48b33af356c10c549fb77677dd3d5

SHA1
3a901035cf0837cb07a759674438746459b87514

SHA256
37bbedfa686361c3c3b42175ee230bb89af2f3529ef9fd92845ce045bbbffa62

SHA512
93e0882dc989fd8b2c1bca308238703a41ffee261dde64c9d8befa1e5dbcabbe76149c9a92a66601bc2cfe991cd28e20d69c880ae841a7e5fd6e262ed76ddb95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
48d7cf87ea05cc35518d9b20fe5392e1

SHA1
6aeb1e7e1f963f3815c4975db45f5d1107b727d2

SHA256
7c92c71e7836d1b71da14c3753d7b506f7f506c051bbf1e3e37a37ff12b691a6

SHA512
ad706b793a18c5c05bbd9df6e070b6aa201c3bcf2d4df4eb8b8c53d61188d84e53f77e6294f8842128f09f925a1802f7550e9e8483bb3c97e91327546599590a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5y2xcxog.54p.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2316-6-0x00000000056D0000-0x00000000056F2000-memory.dmp

Filesize
136KB

Download
memory/2316-4-0x00000000051C0000-0x00000000051CA000-memory.dmp

Filesize
40KB

Download
memory/2316-8-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download
memory/2316-9-0x00000000065B0000-0x0000000006606000-memory.dmp

Filesize
344KB

Download
memory/2316-10-0x00000000066B0000-0x000000000674C000-memory.dmp

Filesize
624KB

Download
memory/2316-7-0x00000000056F0000-0x00000000056FC000-memory.dmp

Filesize
48KB

Download
memory/2316-5-0x0000000074F10000-0x00000000756C0000-memory.dmp

Filesize
7.7MB

Download
memory/2316-1-0x0000000000870000-0x0000000000900000-memory.dmp

Filesize
576KB

Download
memory/2316-15-0x0000000074F10000-0x00000000756C0000-memory.dmp

Filesize
7.7MB

Download
memory/2316-0-0x0000000074F1E000-0x0000000074F1F000-memory.dmp

Filesize
4KB

Download
memory/2316-2-0x0000000005720000-0x0000000005CC4000-memory.dmp

Filesize
5.6MB

Download
memory/2316-3-0x0000000005210000-0x00000000052A2000-memory.dmp

Filesize
584KB

Download
memory/3064-11-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3064-129-0x0000000074F10000-0x00000000756C0000-memory.dmp

Filesize
7.7MB

Download
memory/3064-130-0x0000000074F10000-0x00000000756C0000-memory.dmp

Filesize
7.7MB

Download
memory/3064-131-0x0000000074F10000-0x00000000756C0000-memory.dmp

Filesize
7.7MB

Download
memory/3064-14-0x0000000074F10000-0x00000000756C0000-memory.dmp

Filesize
7.7MB

Download
memory/3620-72-0x0000000070530000-0x000000007057C000-memory.dmp

Filesize
304KB

Download
memory/3728-93-0x0000000070530000-0x000000007057C000-memory.dmp

Filesize
304KB

Download
memory/4300-114-0x0000000070530000-0x000000007057C000-memory.dmp

Filesize
304KB

Download
memory/4560-33-0x0000000005E20000-0x0000000006174000-memory.dmp

Filesize
3.3MB

Download
memory/4560-36-0x0000000007390000-0x00000000073C2000-memory.dmp

Filesize
200KB

Download
memory/4560-37-0x0000000070530000-0x000000007057C000-memory.dmp

Filesize
304KB

Download
memory/4560-47-0x0000000006970000-0x000000000698E000-memory.dmp

Filesize
120KB

Download
memory/4560-48-0x00000000073D0000-0x0000000007473000-memory.dmp

Filesize
652KB

Download
memory/4560-49-0x0000000007D40000-0x00000000083BA000-memory.dmp

Filesize
6.5MB

Download
memory/4560-50-0x0000000007700000-0x000000000771A000-memory.dmp

Filesize
104KB

Download
memory/4560-51-0x0000000007770000-0x000000000777A000-memory.dmp

Filesize
40KB

Download
memory/4560-52-0x0000000007980000-0x0000000007A16000-memory.dmp

Filesize
600KB

Download
memory/4560-53-0x0000000007900000-0x0000000007911000-memory.dmp

Filesize
68KB

Download
memory/4560-54-0x0000000007930000-0x000000000793E000-memory.dmp

Filesize
56KB

Download
memory/4560-55-0x0000000007940000-0x0000000007954000-memory.dmp

Filesize
80KB

Download
memory/4560-56-0x0000000007A40000-0x0000000007A5A000-memory.dmp

Filesize
104KB

Download
memory/4560-57-0x0000000007A20000-0x0000000007A28000-memory.dmp

Filesize
32KB

Download
memory/4560-60-0x0000000074F10000-0x00000000756C0000-memory.dmp

Filesize
7.7MB

Download
memory/4560-35-0x0000000006450000-0x000000000649C000-memory.dmp

Filesize
304KB

Download
memory/4560-34-0x00000000063C0000-0x00000000063DE000-memory.dmp

Filesize
120KB

Download
memory/4560-21-0x0000000005310000-0x0000000005332000-memory.dmp

Filesize
136KB

Download
memory/4560-22-0x0000000005430000-0x0000000005496000-memory.dmp

Filesize
408KB

Download
memory/4560-23-0x0000000005DB0000-0x0000000005E16000-memory.dmp

Filesize
408KB

Download
memory/4560-20-0x0000000074F10000-0x00000000756C0000-memory.dmp

Filesize
7.7MB

Download
memory/4560-19-0x0000000074F10000-0x00000000756C0000-memory.dmp

Filesize
7.7MB

Download
memory/4560-17-0x0000000005610000-0x0000000005C38000-memory.dmp

Filesize
6.2MB

Download
memory/4560-18-0x0000000074F10000-0x00000000756C0000-memory.dmp

Filesize
7.7MB

Download
memory/4560-16-0x0000000002AB0000-0x0000000002AE6000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads