xworm | 8d4e23ba1ce9eab2340bad5e14111dc565bbe8de53653375ac3806f448dcc0ac

Analysis

max time kernel
27s
max time network
28s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OverwolfXclient.exe
Size 1.2MB
Sample240524-xbmnbsfa4x
SHA256 8d4e23ba1ce9eab2340bad5e14111dc565bbe8de53653375ac3806f448dcc0ac
MD5 c08106fd9c5999388d5e541743d45d5b
SHA1 571f4333cd757db2870e2459724b545e43ffcc11
SHA512 65c2e544e88b63e8d1216731be75f0407784d620af1b2dfa649eb87e9e6408ffa43a3697a94c8d4cf6cc9f8dfc83a0a824397ac75bbdde9fe3440802117e8261
SSDEEP 24576:908rin0gKu22AcpyGCcCBSrikukOqk344WIGu31rg:908rin0gKu22AcpyGC9kTOK4WIGWg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

127.0.0.1:7777
45.145.41.147:7777

Mutex

5N4ZirqATbPp1e8c

Attributes

Install_directory
%ProgramData%
install_file
WinBackup.exe

aes.plain

Signatures

Detect Xworm Payload 5 IoCs

resource	yara_rule
behavioral1/memory/2092-6-0x0000000000400000-0x0000000000412000-memory.dmp	family_xworm
behavioral1/memory/2092-9-0x0000000000400000-0x0000000000412000-memory.dmp	family_xworm
behavioral1/memory/2092-7-0x0000000000400000-0x0000000000412000-memory.dmp	family_xworm
behavioral1/memory/2092-11-0x0000000000400000-0x0000000000412000-memory.dmp	family_xworm
behavioral1/memory/2092-13-0x0000000000400000-0x0000000000412000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2832	powershell.exe
2436	powershell.exe
1620	powershell.exe
2972	powershell.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%startupname%.lnk	OverwolfXclient.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinBackup.lnk	MSBuild.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinBackup.lnk	MSBuild.exe

Loads dropped DLL 1 IoCs

pid	Process
2092	MSBuild.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinBackup = "C:\\ProgramData\\WinBackup.exe"	MSBuild.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2220 set thread context of 2092	2220	OverwolfXclient.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1432	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2220	OverwolfXclient.exe
2832	powershell.exe
2436	powershell.exe
1620	powershell.exe
2972	powershell.exe
2092	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2220	OverwolfXclient.exe
Token: SeDebugPrivilege	2092	MSBuild.exe
Token: SeDebugPrivilege	2832	powershell.exe
Token: SeDebugPrivilege	2436	powershell.exe
Token: SeDebugPrivilege	1620	powershell.exe
Token: SeDebugPrivilege	2972	powershell.exe
Token: SeDebugPrivilege	2092	MSBuild.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2092	MSBuild.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1280	2220	OverwolfXclient.exe	28
PID 2220 wrote to memory of 1280	2220	OverwolfXclient.exe	28
PID 2220 wrote to memory of 1280	2220	OverwolfXclient.exe	28
PID 2220 wrote to memory of 1280	2220	OverwolfXclient.exe	28
PID 2220 wrote to memory of 2092	2220	OverwolfXclient.exe	29
PID 2220 wrote to memory of 2092	2220	OverwolfXclient.exe	29
PID 2220 wrote to memory of 2092	2220	OverwolfXclient.exe	29
PID 2220 wrote to memory of 2092	2220	OverwolfXclient.exe	29
PID 2220 wrote to memory of 2092	2220	OverwolfXclient.exe	29
PID 2220 wrote to memory of 2092	2220	OverwolfXclient.exe	29
PID 2220 wrote to memory of 2092	2220	OverwolfXclient.exe	29
PID 2220 wrote to memory of 2092	2220	OverwolfXclient.exe	29
PID 2220 wrote to memory of 2092	2220	OverwolfXclient.exe	29
PID 2092 wrote to memory of 2832	2092	MSBuild.exe	31
PID 2092 wrote to memory of 2832	2092	MSBuild.exe	31
PID 2092 wrote to memory of 2832	2092	MSBuild.exe	31
PID 2092 wrote to memory of 2832	2092	MSBuild.exe	31
PID 2092 wrote to memory of 2436	2092	MSBuild.exe	33
PID 2092 wrote to memory of 2436	2092	MSBuild.exe	33
PID 2092 wrote to memory of 2436	2092	MSBuild.exe	33
PID 2092 wrote to memory of 2436	2092	MSBuild.exe	33
PID 2092 wrote to memory of 1620	2092	MSBuild.exe	35
PID 2092 wrote to memory of 1620	2092	MSBuild.exe	35
PID 2092 wrote to memory of 1620	2092	MSBuild.exe	35
PID 2092 wrote to memory of 1620	2092	MSBuild.exe	35
PID 2092 wrote to memory of 2972	2092	MSBuild.exe	37
PID 2092 wrote to memory of 2972	2092	MSBuild.exe	37
PID 2092 wrote to memory of 2972	2092	MSBuild.exe	37
PID 2092 wrote to memory of 2972	2092	MSBuild.exe	37
PID 2092 wrote to memory of 1432	2092	MSBuild.exe	39
PID 2092 wrote to memory of 1432	2092	MSBuild.exe	39
PID 2092 wrote to memory of 1432	2092	MSBuild.exe	39
PID 2092 wrote to memory of 1432	2092	MSBuild.exe	39

C:\Users\Admin\AppData\Local\Temp\OverwolfXclient.exe
"C:\Users\Admin\AppData\Local\Temp\OverwolfXclient.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1280
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2832
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'MSBuild.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2436
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\WinBackup.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1620
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WinBackup.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2972
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WinBackup" /tr "C:\ProgramData\WinBackup.exe"
    3⤵
    - Creates scheduled task(s)
    PID:1432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 7KB
SHA256 f4eb6e91e781c64cbeb227eeb9443819ff234fee5a0a726fcdf1fad55fef1fee
MD5 f28488e554d07970482ea801a7fbb5c2
SHA1 5fd5d36aaf218772904dc25067ea0e3ee3f68264
SHA512 78e2d6d86e75a26e253d4aadb42ce8b39cba7edc6f30057fabb2d732de9c4e6207b718c5ed5157cba46fa6d047ed2b0b18f117b814df107f641617fd2c5e5781
SSDEEP 96:UnZmC9M8EnqvsqvJCwoBs7nZmC9M8EnqvsEHyqvJCworHsZ5tRpQHwE0E7Y5uXlU:AroUoGroAHnorq5p2P7Y5uC
MD5 SHA1 SHA512 SSDEEP

Submit Download

WinBackup.exe

Path \ProgramData\WinBackup.exe
Size 255KB
SHA256 71d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
MD5 9af17c8393f0970ee5136bd3ffa27001
SHA1 4b285b72c1a11285a25f31f2597e090da6bbc049
SHA512 b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3
SSDEEP 3072:Aao0QHkUQWWimjCKANLpj/WWqvMw2XpFU4rwOequbZSTf02RFifx2u0u6H:3oZZTWxj96pqWpRXfVb02biJrFU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2092-5-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2092-13-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2092-8-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/2092-7-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2092-4-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2092-40-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Download

memory/2092-11-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2092-9-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2092-14-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Download

memory/2092-15-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Download

memory/2092-6-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2092-39-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Download

memory/2220-1-0x0000000000BF0000-0x0000000000D2A000-memory.dmp

Download

memory/2220-3-0x00000000052D0000-0x0000000005386000-memory.dmp

Download

memory/2220-0-0x0000000074DCE000-0x0000000074DCF000-memory.dmp

Download