xworm | 69b4f3e7db53a18e1352367ecbf25dba0b86e96af655e6127db1b1205a181f63

General

Target

csrss.exe
Size

40KB
MD5

e5cb8c66cab6a972529a85480b9881bc
SHA1

58eb0e24f0eb4865838d307df886d2b40bfb77cd
SHA256

69b4f3e7db53a18e1352367ecbf25dba0b86e96af655e6127db1b1205a181f63
SHA512

6c049e084e00eea72b3b78480fb79879c8c961d188178b3c59211bbc69ab25deaf88453dc1f4ec23c08ee80e452a453464780193e849121f2f625f96f0dd26f3
SSDEEP

768:uNfPMSk3K/EzTb/0x8WuFZ4lJF5PC9O9EB68OMh63/aO:uf05a/CTjM89UFc9UEB68OMsx

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

45.141.26.119:1996

Mutex

wHK5NlknpAL3Lk1X

Attributes

Install_directory
%AppData%
install_file
csrss.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2548-1-0x0000000000B70000-0x0000000000B80000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

2696 powershell.exe
2744 powershell.exe
2524 powershell.exe
3000 powershell.exe

pid	process
2696	powershell.exe
2744	powershell.exe
2524	powershell.exe
3000	powershell.exe

Drops startup file 2 IoCs

Processes:

csrss.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.lnk	csrss.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.lnk	csrss.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.execsrss.exe

pid process

2696 powershell.exe
2744 powershell.exe
2524 powershell.exe
3000 powershell.exe
2548 csrss.exe

flow	ioc
4	ip-api.com

pid	process
2696	powershell.exe
2744	powershell.exe
2524	powershell.exe
3000	powershell.exe
2548	csrss.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

csrss.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2548	csrss.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeDebugPrivilege	2524	powershell.exe
Token: SeDebugPrivilege	3000	powershell.exe
Token: SeDebugPrivilege	2548	csrss.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

csrss.exe

pid process

2548 csrss.exe

pid	process
2548	csrss.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

csrss.exe

description	pid	process	target process
PID 2548 wrote to memory of 2696	2548	csrss.exe	powershell.exe
PID 2548 wrote to memory of 2696	2548	csrss.exe	powershell.exe
PID 2548 wrote to memory of 2696	2548	csrss.exe	powershell.exe
PID 2548 wrote to memory of 2744	2548	csrss.exe	powershell.exe
PID 2548 wrote to memory of 2744	2548	csrss.exe	powershell.exe
PID 2548 wrote to memory of 2744	2548	csrss.exe	powershell.exe
PID 2548 wrote to memory of 2524	2548	csrss.exe	powershell.exe
PID 2548 wrote to memory of 2524	2548	csrss.exe	powershell.exe
PID 2548 wrote to memory of 2524	2548	csrss.exe	powershell.exe
PID 2548 wrote to memory of 3000	2548	csrss.exe	powershell.exe
PID 2548 wrote to memory of 3000	2548	csrss.exe	powershell.exe
PID 2548 wrote to memory of 3000	2548	csrss.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\csrss.exe
"C:\Users\Admin\AppData\Local\Temp\csrss.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\csrss.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2696

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'csrss.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2744

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\csrss.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2524

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'csrss.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3000

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
a20c00f0e612d4c9b5ec1ece7828b7e2

SHA1
77fd591433272603790fb32f0663834859da42d6

SHA256
94e816aa7172922e4fd5d7a9081a4bd58d0bf45af624408b57b65760891edba5

SHA512
4c2a586e4553ac6ee2e7789fea4e05b197cb9a036cabc810157518ff10b7c7d62f261084f709564ca4de21cceb5fc40cb25e80f98723a7ebeddd146602c030fe

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2548-0-0x000007FEF5783000-0x000007FEF5784000-memory.dmp

Filesize
4KB

Download
memory/2548-1-0x0000000000B70000-0x0000000000B80000-memory.dmp

Filesize
64KB

Download
memory/2548-2-0x000007FEF5780000-0x000007FEF616C000-memory.dmp

Filesize
9.9MB

Download
memory/2548-32-0x000007FEF5783000-0x000007FEF5784000-memory.dmp

Filesize
4KB

Download
memory/2548-33-0x000007FEF5780000-0x000007FEF616C000-memory.dmp

Filesize
9.9MB

Download
memory/2696-7-0x0000000002D30000-0x0000000002DB0000-memory.dmp

Filesize
512KB

Download
memory/2696-8-0x000000001B700000-0x000000001B9E2000-memory.dmp

Filesize
2.9MB

Download
memory/2696-9-0x0000000001FD0000-0x0000000001FD8000-memory.dmp

Filesize
32KB

Download
memory/2744-15-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/2744-16-0x0000000002690000-0x0000000002698000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads