xworm | 3c786fd8f95d6787bf27728c6aa5d58054c6e923445147229f95de18ac4bbacd

Analysis

max time kernel
9s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
27/05/2024, 08:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Steam.exe
Size 438KB
Sample240527-j22chsec53
SHA256 3c786fd8f95d6787bf27728c6aa5d58054c6e923445147229f95de18ac4bbacd
MD5 4b784bf857356251bccf184911e0e8d8
SHA1 5ef9015b62a62f4b2bff9a34fb5f3d1639a29937
SHA512 73d2b89b3f9b83c18cc3fd270ef26a288625fc339acc29b0e806b57c185313bb7bfc084cddd8cb95449034bef8ac60481c6b150469eaf4ae2c09a1e9efa5f2da
SSDEEP 6144:YfjoMm6fbwY/D8TWrbTP/8+GIIIIIIIhIIIIIIIIIIIIIIIU:sfLheWzPX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/4092-1-0x0000000000DC0000-0x0000000000E34000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1532	powershell.exe
380	powershell.exe
2304	powershell.exe
804	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\Steam = "C:\\ProgramData\\Steam.exe"	Steam.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4620	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1532	powershell.exe
1532	powershell.exe
1532	powershell.exe
380	powershell.exe
380	powershell.exe
380	powershell.exe
2304	powershell.exe
2304	powershell.exe
2304	powershell.exe
804	powershell.exe
804	powershell.exe
804	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4092	Steam.exe
Token: SeDebugPrivilege	1532	powershell.exe
Token: SeIncreaseQuotaPrivilege	1532	powershell.exe
Token: SeSecurityPrivilege	1532	powershell.exe
Token: SeTakeOwnershipPrivilege	1532	powershell.exe
Token: SeLoadDriverPrivilege	1532	powershell.exe
Token: SeSystemProfilePrivilege	1532	powershell.exe
Token: SeSystemtimePrivilege	1532	powershell.exe
Token: SeProfSingleProcessPrivilege	1532	powershell.exe
Token: SeIncBasePriorityPrivilege	1532	powershell.exe
Token: SeCreatePagefilePrivilege	1532	powershell.exe
Token: SeBackupPrivilege	1532	powershell.exe
Token: SeRestorePrivilege	1532	powershell.exe
Token: SeShutdownPrivilege	1532	powershell.exe
Token: SeDebugPrivilege	1532	powershell.exe
Token: SeSystemEnvironmentPrivilege	1532	powershell.exe
Token: SeRemoteShutdownPrivilege	1532	powershell.exe
Token: SeUndockPrivilege	1532	powershell.exe
Token: SeManageVolumePrivilege	1532	powershell.exe
Token: 33	1532	powershell.exe
Token: 34	1532	powershell.exe
Token: 35	1532	powershell.exe
Token: 36	1532	powershell.exe
Token: SeDebugPrivilege	380	powershell.exe
Token: SeIncreaseQuotaPrivilege	380	powershell.exe
Token: SeSecurityPrivilege	380	powershell.exe
Token: SeTakeOwnershipPrivilege	380	powershell.exe
Token: SeLoadDriverPrivilege	380	powershell.exe
Token: SeSystemProfilePrivilege	380	powershell.exe
Token: SeSystemtimePrivilege	380	powershell.exe
Token: SeProfSingleProcessPrivilege	380	powershell.exe
Token: SeIncBasePriorityPrivilege	380	powershell.exe
Token: SeCreatePagefilePrivilege	380	powershell.exe
Token: SeBackupPrivilege	380	powershell.exe
Token: SeRestorePrivilege	380	powershell.exe
Token: SeShutdownPrivilege	380	powershell.exe
Token: SeDebugPrivilege	380	powershell.exe
Token: SeSystemEnvironmentPrivilege	380	powershell.exe
Token: SeRemoteShutdownPrivilege	380	powershell.exe
Token: SeUndockPrivilege	380	powershell.exe
Token: SeManageVolumePrivilege	380	powershell.exe
Token: 33	380	powershell.exe
Token: 34	380	powershell.exe
Token: 35	380	powershell.exe
Token: 36	380	powershell.exe
Token: SeDebugPrivilege	2304	powershell.exe
Token: SeIncreaseQuotaPrivilege	2304	powershell.exe
Token: SeSecurityPrivilege	2304	powershell.exe
Token: SeTakeOwnershipPrivilege	2304	powershell.exe
Token: SeLoadDriverPrivilege	2304	powershell.exe
Token: SeSystemProfilePrivilege	2304	powershell.exe
Token: SeSystemtimePrivilege	2304	powershell.exe
Token: SeProfSingleProcessPrivilege	2304	powershell.exe
Token: SeIncBasePriorityPrivilege	2304	powershell.exe
Token: SeCreatePagefilePrivilege	2304	powershell.exe
Token: SeBackupPrivilege	2304	powershell.exe
Token: SeRestorePrivilege	2304	powershell.exe
Token: SeShutdownPrivilege	2304	powershell.exe
Token: SeDebugPrivilege	2304	powershell.exe
Token: SeSystemEnvironmentPrivilege	2304	powershell.exe
Token: SeRemoteShutdownPrivilege	2304	powershell.exe
Token: SeUndockPrivilege	2304	powershell.exe
Token: SeManageVolumePrivilege	2304	powershell.exe
Token: 33	2304	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 1532	4092	Steam.exe	73
PID 4092 wrote to memory of 1532	4092	Steam.exe	73
PID 4092 wrote to memory of 380	4092	Steam.exe	76
PID 4092 wrote to memory of 380	4092	Steam.exe	76
PID 4092 wrote to memory of 2304	4092	Steam.exe	78
PID 4092 wrote to memory of 2304	4092	Steam.exe	78
PID 4092 wrote to memory of 804	4092	Steam.exe	80
PID 4092 wrote to memory of 804	4092	Steam.exe	80
PID 4092 wrote to memory of 4620	4092	Steam.exe	82
PID 4092 wrote to memory of 4620	4092	Steam.exe	82

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Steam.exe
"C:\Users\Admin\AppData\Local\Temp\Steam.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Steam.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Steam.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Steam.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Steam.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:804
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Steam" /tr "C:\ProgramData\Steam.exe"
  2⤵
  - Creates scheduled task(s)
  PID:4620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033
MD5 ad5cd538ca58cb28ede39c108acb5785
SHA1 1ae910026f3dbe90ed025e9e96ead2b5399be877
SHA512 c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 00992e52fe4c0eda645864290336ff6dbb3bbc3ed6f64779bb5d3fb4640effcc
MD5 f7e474e7fc24de2b3f6ee2938e35a2be
SHA1 5ca6d78605ab28833610e35836805684a5bf6e54
SHA512 bb8bbed1d0aad055d7ea421b9c415d402b1fcadc5b013183c00fc61bca7e7e4487617200a5ffb7ee6afad5568927ae9bf022d55676271d6cee27f36b2428665d
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3d42bd421f5fc7e5f49c3ca4b7011ffe2a3b19825f4730a225fb2bd76bdd00f2
MD5 948dc913d378b4af1d44c540aea74a3c
SHA1 1bfa4fe1fa4fc44ea8b387c32deff756a1f282cf
SHA512 86599d8a2988dc9c98b3c57399ee152c404f60e586e15ca150d03ddc1b76156bff215673f90196e6455fe66ffcde157e67b017dd6c31cd4aa0e54e1287ea62ca
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f8f030865803db3213286e33992c61602ecb112d0774107e28742b2cd518de8f
MD5 36329a8be446311db3199c3f619d7f4f
SHA1 280298ba280db11d9783990114c9540908ddba55
SHA512 1a10a4a2d52d9f1b94e8684f80408f357511dd0a52154a4243ce8559f94dc603655899125b38c4f8ddb351e5c6d7190e6ff3ddf1a9cfec30348644d9140e3475
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_2uvj5ccf.ywa.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2uvj5ccf.ywa.ps1
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

memory/1532-8-0x00007FFA56F60000-0x00007FFA5794C000-memory.dmp

Download

memory/1532-12-0x000002081BA40000-0x000002081BAB6000-memory.dmp

Download

memory/1532-9-0x00007FFA56F60000-0x00007FFA5794C000-memory.dmp

Download

memory/1532-41-0x00007FFA56F60000-0x00007FFA5794C000-memory.dmp

Download

memory/1532-48-0x00007FFA56F60000-0x00007FFA5794C000-memory.dmp

Download

memory/1532-52-0x00007FFA56F60000-0x00007FFA5794C000-memory.dmp

Download

memory/1532-7-0x00007FFA56F60000-0x00007FFA5794C000-memory.dmp

Download

memory/1532-6-0x000002081B830000-0x000002081B852000-memory.dmp

Download

memory/4092-0-0x00007FFA56F63000-0x00007FFA56F64000-memory.dmp

Download

memory/4092-1-0x0000000000DC0000-0x0000000000E34000-memory.dmp

Download

memory/4092-184-0x00007FFA56F60000-0x00007FFA5794C000-memory.dmp

Download