xworm | 2d1c1347b0e889a6f74fed1878738e0026ea2fe10c8082d9ba5fcdb0e8ed939b

General

Target

SecuriteInfo.com.Win64.PWSXgen.10080.20186.exe
Size

1.4MB
MD5

e84bb6efc8e0ebec1826b770cfb59bd9
SHA1

5fe35e0b634a95fcff997882839004a225a29bf1
SHA256

2d1c1347b0e889a6f74fed1878738e0026ea2fe10c8082d9ba5fcdb0e8ed939b
SHA512

562cef1a697cdb516d09341b58d790984284b6617ba5a24040b1a36ae3cd448b8857a7e5dcd1f541d5e18888fe7b525894077fce08463d5a7dfe2b00eb0de810
SSDEEP

24576:uOnCbIk+tdLb0Tj3ndie/UV7EMhD6ZnlyBI0DJewitKUiVh8t6S9U8XxT9Q+FTtT:prUlH0UcBS9UutT

Score

10^/10

xworm evasion execution rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

79.110.49.133:5700

Mutex

Bg9JRZDpyEfXxrAy

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 5 IoCs

resource	yara_rule
behavioral1/memory/2672-27-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm
behavioral1/memory/2672-29-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm
behavioral1/memory/2672-25-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm
behavioral1/memory/2672-22-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm
behavioral1/memory/2672-20-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SecuriteInfo.com.Win64.PWSXgen.10080.20186.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2288	powershell.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SecuriteInfo.com.Win64.PWSXgen.10080.20186.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SecuriteInfo.com.Win64.PWSXgen.10080.20186.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2972 set thread context of 2672	2972	SecuriteInfo.com.Win64.PWSXgen.10080.20186.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2288	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2288	powershell.exe
Token: SeDebugPrivilege	2672	jsc.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2288	2972	SecuriteInfo.com.Win64.PWSXgen.10080.20186.exe	29
PID 2972 wrote to memory of 2288	2972	SecuriteInfo.com.Win64.PWSXgen.10080.20186.exe	29
PID 2972 wrote to memory of 2288	2972	SecuriteInfo.com.Win64.PWSXgen.10080.20186.exe	29
PID 2972 wrote to memory of 2100	2972	SecuriteInfo.com.Win64.PWSXgen.10080.20186.exe	31
PID 2972 wrote to memory of 2100	2972	SecuriteInfo.com.Win64.PWSXgen.10080.20186.exe	31
PID 2972 wrote to memory of 2100	2972	SecuriteInfo.com.Win64.PWSXgen.10080.20186.exe	31
PID 2972 wrote to memory of 2100	2972	SecuriteInfo.com.Win64.PWSXgen.10080.20186.exe	31
PID 2972 wrote to memory of 2100	2972	SecuriteInfo.com.Win64.PWSXgen.10080.20186.exe	31
PID 2972 wrote to memory of 2100	2972	SecuriteInfo.com.Win64.PWSXgen.10080.20186.exe	31
PID 2972 wrote to memory of 2100	2972	SecuriteInfo.com.Win64.PWSXgen.10080.20186.exe	31
PID 2972 wrote to memory of 2672	2972	SecuriteInfo.com.Win64.PWSXgen.10080.20186.exe	32
PID 2972 wrote to memory of 2672	2972	SecuriteInfo.com.Win64.PWSXgen.10080.20186.exe	32
PID 2972 wrote to memory of 2672	2972	SecuriteInfo.com.Win64.PWSXgen.10080.20186.exe	32
PID 2972 wrote to memory of 2672	2972	SecuriteInfo.com.Win64.PWSXgen.10080.20186.exe	32
PID 2972 wrote to memory of 2672	2972	SecuriteInfo.com.Win64.PWSXgen.10080.20186.exe	32
PID 2972 wrote to memory of 2672	2972	SecuriteInfo.com.Win64.PWSXgen.10080.20186.exe	32
PID 2972 wrote to memory of 2672	2972	SecuriteInfo.com.Win64.PWSXgen.10080.20186.exe	32
PID 2972 wrote to memory of 2672	2972	SecuriteInfo.com.Win64.PWSXgen.10080.20186.exe	32
PID 2972 wrote to memory of 2672	2972	SecuriteInfo.com.Win64.PWSXgen.10080.20186.exe	32
PID 2972 wrote to memory of 2548	2972	SecuriteInfo.com.Win64.PWSXgen.10080.20186.exe	33
PID 2972 wrote to memory of 2548	2972	SecuriteInfo.com.Win64.PWSXgen.10080.20186.exe	33
PID 2972 wrote to memory of 2548	2972	SecuriteInfo.com.Win64.PWSXgen.10080.20186.exe	33

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SecuriteInfo.com.Win64.PWSXgen.10080.20186.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.PWSXgen.10080.20186.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.PWSXgen.10080.20186.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.PWSXgen.10080.20186.exe" -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2288
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2⤵
  PID:2100
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2672
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2972 -s 736
  2⤵
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2288-13-0x00000000023D0000-0x00000000023D8000-memory.dmp

Filesize
32KB

Download
memory/2288-33-0x000007FEEDE10000-0x000007FEEE7AD000-memory.dmp

Filesize
9.6MB

Download
memory/2288-32-0x000007FEEDE10000-0x000007FEEE7AD000-memory.dmp

Filesize
9.6MB

Download
memory/2288-31-0x000007FEEDE10000-0x000007FEEE7AD000-memory.dmp

Filesize
9.6MB

Download
memory/2288-30-0x000007FEEDE10000-0x000007FEEE7AD000-memory.dmp

Filesize
9.6MB

Download
memory/2288-15-0x000007FEEDE10000-0x000007FEEE7AD000-memory.dmp

Filesize
9.6MB

Download
memory/2288-14-0x000007FEEDE10000-0x000007FEEE7AD000-memory.dmp

Filesize
9.6MB

Download
memory/2288-11-0x000007FEEE0CE000-0x000007FEEE0CF000-memory.dmp

Filesize
4KB

Download
memory/2288-12-0x000000001B590000-0x000000001B872000-memory.dmp

Filesize
2.9MB

Download
memory/2672-18-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2672-20-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2672-27-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2672-29-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2672-25-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2672-16-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2672-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2672-22-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2972-0-0x000007FEF5853000-0x000007FEF5854000-memory.dmp

Filesize
4KB

Download
memory/2972-6-0x000000001A8C0000-0x000000001A922000-memory.dmp

Filesize
392KB

Download
memory/2972-5-0x000007FEF5850000-0x000007FEF623C000-memory.dmp

Filesize
9.9MB

Download
memory/2972-4-0x000007FEF5850000-0x000007FEF623C000-memory.dmp

Filesize
9.9MB

Download
memory/2972-3-0x000007FEF5850000-0x000007FEF623C000-memory.dmp

Filesize
9.9MB

Download
memory/2972-2-0x000007FEF5850000-0x000007FEF623C000-memory.dmp

Filesize
9.9MB

Download
memory/2972-1-0x0000000000130000-0x0000000000144000-memory.dmp

Filesize
80KB

Download
memory/2972-34-0x000007FEF5850000-0x000007FEF623C000-memory.dmp

Filesize
9.9MB

Download
memory/2972-35-0x000007FEF5853000-0x000007FEF5854000-memory.dmp

Filesize
4KB

Download
memory/2972-36-0x000007FEF5850000-0x000007FEF623C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads