xworm | b542502918e537abff66105f9432f29e6d8ba7d4169b7d2894dd9ed3261e0141

General

Target

b542502918e537abff66105f9432f29e6d8ba7d4169b7d2894dd9ed3261e0141.exe
Size

1.1MB
MD5

78bd2bd5c0e94fa766e367a168bb4533
SHA1

d7ea5bca4e50e39c6dca8c7b6831d7600c3ce2bb
SHA256

b542502918e537abff66105f9432f29e6d8ba7d4169b7d2894dd9ed3261e0141
SHA512

1a656e55ad828cc27956446a2d5e4d74b01d56d373aec3bb64c86d5239f4bebb225dc04af1bfebc8d7738c70578cc860e395992faddfbf69a9811c3871a8fe5b
SSDEEP

24576:x8BmfWBiORmU0z9TY4VE6tH/R5Hn8AFFsY7bP78:uUjH/zfLsqP78

Score

10^/10

xworm evasion execution rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

79.110.49.133:5700

Mutex

Bg9JRZDpyEfXxrAy

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 5 IoCs

resource	yara_rule
behavioral1/memory/2632-24-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm
behavioral1/memory/2632-22-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm
behavioral1/memory/2632-20-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm
behavioral1/memory/2632-17-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm
behavioral1/memory/2632-15-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b542502918e537abff66105f9432f29e6d8ba7d4169b7d2894dd9ed3261e0141.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detects Windows executables referencing non-Windows User-Agents 5 IoCs

resource	yara_rule
behavioral1/memory/2632-24-0x0000000000400000-0x000000000040E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2632-22-0x0000000000400000-0x000000000040E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2632-20-0x0000000000400000-0x000000000040E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2632-17-0x0000000000400000-0x000000000040E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2632-15-0x0000000000400000-0x000000000040E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables packed with or use KoiVM 1 IoCs

resource	yara_rule
behavioral1/memory/1700-6-0x0000000001F30000-0x0000000001F90000-memory.dmp	INDICATOR_EXE_Packed_KoiVM

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3024	powershell.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b542502918e537abff66105f9432f29e6d8ba7d4169b7d2894dd9ed3261e0141.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	b542502918e537abff66105f9432f29e6d8ba7d4169b7d2894dd9ed3261e0141.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1700 set thread context of 2632	1700	b542502918e537abff66105f9432f29e6d8ba7d4169b7d2894dd9ed3261e0141.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3024	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3024	powershell.exe
Token: SeDebugPrivilege	2632	regasm.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 3024	1700	b542502918e537abff66105f9432f29e6d8ba7d4169b7d2894dd9ed3261e0141.exe	29
PID 1700 wrote to memory of 3024	1700	b542502918e537abff66105f9432f29e6d8ba7d4169b7d2894dd9ed3261e0141.exe	29
PID 1700 wrote to memory of 3024	1700	b542502918e537abff66105f9432f29e6d8ba7d4169b7d2894dd9ed3261e0141.exe	29
PID 1700 wrote to memory of 2632	1700	b542502918e537abff66105f9432f29e6d8ba7d4169b7d2894dd9ed3261e0141.exe	31
PID 1700 wrote to memory of 2632	1700	b542502918e537abff66105f9432f29e6d8ba7d4169b7d2894dd9ed3261e0141.exe	31
PID 1700 wrote to memory of 2632	1700	b542502918e537abff66105f9432f29e6d8ba7d4169b7d2894dd9ed3261e0141.exe	31
PID 1700 wrote to memory of 2632	1700	b542502918e537abff66105f9432f29e6d8ba7d4169b7d2894dd9ed3261e0141.exe	31
PID 1700 wrote to memory of 2632	1700	b542502918e537abff66105f9432f29e6d8ba7d4169b7d2894dd9ed3261e0141.exe	31
PID 1700 wrote to memory of 2632	1700	b542502918e537abff66105f9432f29e6d8ba7d4169b7d2894dd9ed3261e0141.exe	31
PID 1700 wrote to memory of 2632	1700	b542502918e537abff66105f9432f29e6d8ba7d4169b7d2894dd9ed3261e0141.exe	31
PID 1700 wrote to memory of 2632	1700	b542502918e537abff66105f9432f29e6d8ba7d4169b7d2894dd9ed3261e0141.exe	31
PID 1700 wrote to memory of 2632	1700	b542502918e537abff66105f9432f29e6d8ba7d4169b7d2894dd9ed3261e0141.exe	31
PID 1700 wrote to memory of 2632	1700	b542502918e537abff66105f9432f29e6d8ba7d4169b7d2894dd9ed3261e0141.exe	31
PID 1700 wrote to memory of 2632	1700	b542502918e537abff66105f9432f29e6d8ba7d4169b7d2894dd9ed3261e0141.exe	31
PID 1700 wrote to memory of 2632	1700	b542502918e537abff66105f9432f29e6d8ba7d4169b7d2894dd9ed3261e0141.exe	31
PID 1700 wrote to memory of 2860	1700	b542502918e537abff66105f9432f29e6d8ba7d4169b7d2894dd9ed3261e0141.exe	32
PID 1700 wrote to memory of 2860	1700	b542502918e537abff66105f9432f29e6d8ba7d4169b7d2894dd9ed3261e0141.exe	32
PID 1700 wrote to memory of 2860	1700	b542502918e537abff66105f9432f29e6d8ba7d4169b7d2894dd9ed3261e0141.exe	32

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b542502918e537abff66105f9432f29e6d8ba7d4169b7d2894dd9ed3261e0141.exe

C:\Users\Admin\AppData\Local\Temp\b542502918e537abff66105f9432f29e6d8ba7d4169b7d2894dd9ed3261e0141.exe
"C:\Users\Admin\AppData\Local\Temp\b542502918e537abff66105f9432f29e6d8ba7d4169b7d2894dd9ed3261e0141.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b542502918e537abff66105f9432f29e6d8ba7d4169b7d2894dd9ed3261e0141.exe" -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3024
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2632
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1700 -s 668
  2⤵
  PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1700-0-0x000007FEF5D53000-0x000007FEF5D54000-memory.dmp

Filesize
4KB

Download
memory/1700-1-0x0000000000130000-0x000000000013C000-memory.dmp

Filesize
48KB

Download
memory/1700-2-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

Filesize
9.9MB

Download
memory/1700-3-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

Filesize
9.9MB

Download
memory/1700-4-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

Filesize
9.9MB

Download
memory/1700-5-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

Filesize
9.9MB

Download
memory/1700-6-0x0000000001F30000-0x0000000001F90000-memory.dmp

Filesize
384KB

Download
memory/1700-34-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

Filesize
9.9MB

Download
memory/1700-33-0x000007FEF5D53000-0x000007FEF5D54000-memory.dmp

Filesize
4KB

Download
memory/2632-20-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2632-13-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2632-22-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2632-24-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2632-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2632-17-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2632-15-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2632-11-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3024-26-0x000000001B6B0000-0x000000001B992000-memory.dmp

Filesize
2.9MB

Download
memory/3024-28-0x000007FEEE250000-0x000007FEEEBED000-memory.dmp

Filesize
9.6MB

Download
memory/3024-29-0x000007FEEE250000-0x000007FEEEBED000-memory.dmp

Filesize
9.6MB

Download
memory/3024-30-0x000007FEEE250000-0x000007FEEEBED000-memory.dmp

Filesize
9.6MB

Download
memory/3024-31-0x000007FEEE250000-0x000007FEEEBED000-memory.dmp

Filesize
9.6MB

Download
memory/3024-32-0x000007FEEE250000-0x000007FEEEBED000-memory.dmp

Filesize
9.6MB

Download
memory/3024-27-0x0000000001F80000-0x0000000001F88000-memory.dmp

Filesize
32KB

Download
memory/3024-25-0x000007FEEE50E000-0x000007FEEE50F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads