xworm | 2d2e27dc029c468d7a019fcde90fb2ffddd0bf02cafa0357cd86310645bb7473

Analysis

max time kernel
89s
max time network
99s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
28/05/2024, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
GameClient.exe
Size 79KB
Sample240528-pynvxafa37
SHA256 2d2e27dc029c468d7a019fcde90fb2ffddd0bf02cafa0357cd86310645bb7473
MD5 81630e94eabda4e1a57ac4f1952db556
SHA1 9d7276205d8cedba924859bbbbef305890baff23
SHA512 f9dca5f30cc1908d47a806c5b2b3a1c1b8c3c3b75bbdac9811307f83f4ac2fabcb6f2ae7630c9f25e7be5f710c525b63f49fa814c1d498d1d0872b5d9a7d3bec
SSDEEP 1536:ZG0+RNQYxXBpLLLoypsKCJJ5Ybimcg6cbD8K3QG6VG6xqhGpOggM3xZRw:Zb+RN5bLGFYbi7cDVg9A+OggM5w
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

https://pastebin.com/raw/qaWffTar:5

Attributes

Install_directory
%AppData%
install_file
svchost.exe
pastebin_url
https://pastebin.com/raw/qaWffTar

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/1744-188-0x000000001BA30000-0x000000001BA3E000-memory.dmp	disable_win_def

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/memory/1744-1-0x0000000000D80000-0x0000000000D9A000-memory.dmp	family_xworm
behavioral1/files/0x000d00000001aa25-190.dat	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1232	powershell.exe
4932	powershell.exe
240	powershell.exe
4648	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	GameClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	GameClient.exe

Executes dropped EXE 1 IoCs

pid	Process
3000	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	GameClient.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	pastebin.com
7	pastebin.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2008	schtasks.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
240	powershell.exe
240	powershell.exe
240	powershell.exe
4648	powershell.exe
4648	powershell.exe
4648	powershell.exe
1232	powershell.exe
1232	powershell.exe
1232	powershell.exe
4932	powershell.exe
4932	powershell.exe
4932	powershell.exe
1744	GameClient.exe
1744	GameClient.exe
1744	GameClient.exe
1744	GameClient.exe
1744	GameClient.exe
1744	GameClient.exe
1744	GameClient.exe
1744	GameClient.exe
1744	GameClient.exe
1744	GameClient.exe
1744	GameClient.exe
1744	GameClient.exe
1744	GameClient.exe
1744	GameClient.exe
1744	GameClient.exe
1744	GameClient.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1744	GameClient.exe
Token: SeDebugPrivilege	240	powershell.exe
Token: SeIncreaseQuotaPrivilege	240	powershell.exe
Token: SeSecurityPrivilege	240	powershell.exe
Token: SeTakeOwnershipPrivilege	240	powershell.exe
Token: SeLoadDriverPrivilege	240	powershell.exe
Token: SeSystemProfilePrivilege	240	powershell.exe
Token: SeSystemtimePrivilege	240	powershell.exe
Token: SeProfSingleProcessPrivilege	240	powershell.exe
Token: SeIncBasePriorityPrivilege	240	powershell.exe
Token: SeCreatePagefilePrivilege	240	powershell.exe
Token: SeBackupPrivilege	240	powershell.exe
Token: SeRestorePrivilege	240	powershell.exe
Token: SeShutdownPrivilege	240	powershell.exe
Token: SeDebugPrivilege	240	powershell.exe
Token: SeSystemEnvironmentPrivilege	240	powershell.exe
Token: SeRemoteShutdownPrivilege	240	powershell.exe
Token: SeUndockPrivilege	240	powershell.exe
Token: SeManageVolumePrivilege	240	powershell.exe
Token: 33	240	powershell.exe
Token: 34	240	powershell.exe
Token: 35	240	powershell.exe
Token: 36	240	powershell.exe
Token: SeDebugPrivilege	4648	powershell.exe
Token: SeIncreaseQuotaPrivilege	4648	powershell.exe
Token: SeSecurityPrivilege	4648	powershell.exe
Token: SeTakeOwnershipPrivilege	4648	powershell.exe
Token: SeLoadDriverPrivilege	4648	powershell.exe
Token: SeSystemProfilePrivilege	4648	powershell.exe
Token: SeSystemtimePrivilege	4648	powershell.exe
Token: SeProfSingleProcessPrivilege	4648	powershell.exe
Token: SeIncBasePriorityPrivilege	4648	powershell.exe
Token: SeCreatePagefilePrivilege	4648	powershell.exe
Token: SeBackupPrivilege	4648	powershell.exe
Token: SeRestorePrivilege	4648	powershell.exe
Token: SeShutdownPrivilege	4648	powershell.exe
Token: SeDebugPrivilege	4648	powershell.exe
Token: SeSystemEnvironmentPrivilege	4648	powershell.exe
Token: SeRemoteShutdownPrivilege	4648	powershell.exe
Token: SeUndockPrivilege	4648	powershell.exe
Token: SeManageVolumePrivilege	4648	powershell.exe
Token: 33	4648	powershell.exe
Token: 34	4648	powershell.exe
Token: 35	4648	powershell.exe
Token: 36	4648	powershell.exe
Token: SeDebugPrivilege	1232	powershell.exe
Token: SeIncreaseQuotaPrivilege	1232	powershell.exe
Token: SeSecurityPrivilege	1232	powershell.exe
Token: SeTakeOwnershipPrivilege	1232	powershell.exe
Token: SeLoadDriverPrivilege	1232	powershell.exe
Token: SeSystemProfilePrivilege	1232	powershell.exe
Token: SeSystemtimePrivilege	1232	powershell.exe
Token: SeProfSingleProcessPrivilege	1232	powershell.exe
Token: SeIncBasePriorityPrivilege	1232	powershell.exe
Token: SeCreatePagefilePrivilege	1232	powershell.exe
Token: SeBackupPrivilege	1232	powershell.exe
Token: SeRestorePrivilege	1232	powershell.exe
Token: SeShutdownPrivilege	1232	powershell.exe
Token: SeDebugPrivilege	1232	powershell.exe
Token: SeSystemEnvironmentPrivilege	1232	powershell.exe
Token: SeRemoteShutdownPrivilege	1232	powershell.exe
Token: SeUndockPrivilege	1232	powershell.exe
Token: SeManageVolumePrivilege	1232	powershell.exe
Token: 33	1232	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1744	GameClient.exe
4632	LogonUI.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 240	1744	GameClient.exe	73
PID 1744 wrote to memory of 240	1744	GameClient.exe	73
PID 1744 wrote to memory of 4648	1744	GameClient.exe	76
PID 1744 wrote to memory of 4648	1744	GameClient.exe	76
PID 1744 wrote to memory of 1232	1744	GameClient.exe	78
PID 1744 wrote to memory of 1232	1744	GameClient.exe	78
PID 1744 wrote to memory of 4932	1744	GameClient.exe	80
PID 1744 wrote to memory of 4932	1744	GameClient.exe	80
PID 1744 wrote to memory of 2008	1744	GameClient.exe	82
PID 1744 wrote to memory of 2008	1744	GameClient.exe	82
PID 1744 wrote to memory of 1240	1744	GameClient.exe	86
PID 1744 wrote to memory of 1240	1744	GameClient.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\GameClient.exe
"C:\Users\Admin\AppData\Local\Temp\GameClient.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\GameClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'GameClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4932
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Creates scheduled task(s)
  PID:2008
- C:\Windows\SYSTEM32\shutdown.exe
  shutdown.exe /f /s /t 0
  2⤵
  PID:1240

C:\Users\Admin\AppData\Roaming\svchost.exe
C:\Users\Admin\AppData\Roaming\svchost.exe
1⤵
- Executes dropped EXE
PID:3000

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3af1055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c
MD5 8592ba100a78835a6b94d5949e13dfc1
SHA1 63e901200ab9a57c7dd4c078d7f75dcd3b357020
SHA512 87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e4a6a64e6d3d8853e94eee2b7cea8d5c392bb98f451eb75321c40953482fb549
MD5 1fe692efcc22335445803c52a8135dc8
SHA1 1cd7e3b4a59a03bee5218fd1093b74f0fede3bbb
SHA512 08a815b594e0341d6efa8cff01e1eabb6709936fef103d2b28b505557a756c8b4b66089cc800bd77d93fc8485ea9ddf037cc46dae24fe898d06f1311494e839f
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 113ab89d2d7140a4e7792cf5bbf86521d072f88a0f69853838c8270b4d91e66d
MD5 c05cac6553f35bb8d585bcc66785c591
SHA1 ab0efae1bde4f3326210038844c4f0540e4ad172
SHA512 02cdc392995fd45ce7481865c91e7786e1bd56b3f67f43ab5fac5b2dcfc5206477e546a72fee7c8925ffd8ed12454fd2996f314e48abfec5156c56bc4c08bdd7
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6e9016e0524054400764f6970498c87de4d2c9cfe56b27ae164b74ab92a7ef5d
MD5 08df239c9ceb790e8de7dbbd1acffa65
SHA1 5221be569f8dbb2b215688ef533cfb1f68c087e8
SHA512 194b1d83326b428626fc26074428dd7a2ebadffaf6f81b0529abbef3aa5e5d9ec667e3414d194f81e3c54411206c86efe33e9d7f81257c3b08716e156a67d4b3
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_l3dcqgf2.4tq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l3dcqgf2.4tq.ps1
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 79KB
SHA256 2d2e27dc029c468d7a019fcde90fb2ffddd0bf02cafa0357cd86310645bb7473
MD5 81630e94eabda4e1a57ac4f1952db556
SHA1 9d7276205d8cedba924859bbbbef305890baff23
SHA512 f9dca5f30cc1908d47a806c5b2b3a1c1b8c3c3b75bbdac9811307f83f4ac2fabcb6f2ae7630c9f25e7be5f710c525b63f49fa814c1d498d1d0872b5d9a7d3bec
SSDEEP 1536:ZG0+RNQYxXBpLLLoypsKCJJ5Ybimcg6cbD8K3QG6VG6xqhGpOggM3xZRw:Zb+RN5bLGFYbi7cDVg9A+OggM5w
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/240-7-0x000001722DCB0000-0x000001722DCD2000-memory.dmp

Download

memory/240-12-0x0000017246320000-0x0000017246396000-memory.dmp

Download

memory/240-13-0x00007FFC0C720000-0x00007FFC0D10C000-memory.dmp

Download

memory/240-51-0x00007FFC0C720000-0x00007FFC0D10C000-memory.dmp

Download

memory/240-9-0x00007FFC0C720000-0x00007FFC0D10C000-memory.dmp

Download

memory/240-8-0x00007FFC0C720000-0x00007FFC0D10C000-memory.dmp

Download

memory/1744-0-0x00007FFC0C723000-0x00007FFC0C724000-memory.dmp

Download

memory/1744-2-0x00007FFC0C720000-0x00007FFC0D10C000-memory.dmp

Download

memory/1744-186-0x00007FFC0C723000-0x00007FFC0C724000-memory.dmp

Download

memory/1744-187-0x00007FFC0C720000-0x00007FFC0D10C000-memory.dmp

Download

memory/1744-188-0x000000001BA30000-0x000000001BA3E000-memory.dmp

Download

memory/1744-1-0x0000000000D80000-0x0000000000D9A000-memory.dmp

Download

memory/1744-193-0x00007FFC0C720000-0x00007FFC0D10C000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads