xworm | d8f968a5732220f35ab7094f13537d1d68405ed10362737848a87e5a71773e9d

General

Target

WaveTrial.exe
Size

86KB
MD5

5cb8f4aa69339acc85ef9d2ca60b0c07
SHA1

bb12de5f0a59eda98ba82e4a81dd24d80b8d7844
SHA256

d8f968a5732220f35ab7094f13537d1d68405ed10362737848a87e5a71773e9d
SHA512

f8908f96cfff0498b977c2d790709cc02408068999f520a9727e3eff4e260092fd1c1b8fcf13d0cc217298f0e91a0b55fb30f88bba515fa08ed8b66465c07540
SSDEEP

1536:VVOy37Fk3kKmog7DldgQatSL4Jj6+l7lbOL5zWx1fRkTqP6nPbuE1ONz5UrQWSK0:ctmog7DjgfmmbO14CP3ONzCrQC0

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:2619

20.ip.gl.ply.gg:2619

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral1/memory/2172-1-0x00000000002C0000-0x00000000002DC000-memory.dmp	family_xworm
behavioral1/files/0x0026000000015c0d-33.dat	family_xworm
behavioral1/memory/1964-35-0x00000000000A0000-0x00000000000BC000-memory.dmp	family_xworm
behavioral1/memory/2776-38-0x0000000001270000-0x000000000128C000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2664	powershell.exe
2276	powershell.exe
2772	powershell.exe
2756	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WaveLauncher.lnk	WaveTrial.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WaveLauncher.lnk	WaveTrial.exe

Executes dropped EXE 2 IoCs

pid	Process
1964	WaveLauncher
2776	WaveLauncher

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\WaveLauncher = "C:\\Users\\Admin\\AppData\\Roaming\\WaveLauncher"	WaveTrial.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3032	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2276	powershell.exe
2772	powershell.exe
2756	powershell.exe
2664	powershell.exe
2172	WaveTrial.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2172	WaveTrial.exe
Token: SeDebugPrivilege	2276	powershell.exe
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeDebugPrivilege	2756	powershell.exe
Token: SeDebugPrivilege	2664	powershell.exe
Token: SeDebugPrivilege	2172	WaveTrial.exe
Token: SeDebugPrivilege	1964	WaveLauncher
Token: SeDebugPrivilege	2776	WaveLauncher

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2172	WaveTrial.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2276	2172	WaveTrial.exe	28
PID 2172 wrote to memory of 2276	2172	WaveTrial.exe	28
PID 2172 wrote to memory of 2276	2172	WaveTrial.exe	28
PID 2172 wrote to memory of 2772	2172	WaveTrial.exe	30
PID 2172 wrote to memory of 2772	2172	WaveTrial.exe	30
PID 2172 wrote to memory of 2772	2172	WaveTrial.exe	30
PID 2172 wrote to memory of 2756	2172	WaveTrial.exe	32
PID 2172 wrote to memory of 2756	2172	WaveTrial.exe	32
PID 2172 wrote to memory of 2756	2172	WaveTrial.exe	32
PID 2172 wrote to memory of 2664	2172	WaveTrial.exe	34
PID 2172 wrote to memory of 2664	2172	WaveTrial.exe	34
PID 2172 wrote to memory of 2664	2172	WaveTrial.exe	34
PID 2172 wrote to memory of 3032	2172	WaveTrial.exe	36
PID 2172 wrote to memory of 3032	2172	WaveTrial.exe	36
PID 2172 wrote to memory of 3032	2172	WaveTrial.exe	36
PID 2024 wrote to memory of 1964	2024	taskeng.exe	42
PID 2024 wrote to memory of 1964	2024	taskeng.exe	42
PID 2024 wrote to memory of 1964	2024	taskeng.exe	42
PID 2024 wrote to memory of 2776	2024	taskeng.exe	43
PID 2024 wrote to memory of 2776	2024	taskeng.exe	43
PID 2024 wrote to memory of 2776	2024	taskeng.exe	43

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\WaveTrial.exe
"C:\Users\Admin\AppData\Local\Temp\WaveTrial.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WaveTrial.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WaveTrial.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WaveLauncher'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WaveLauncher'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2664
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WaveLauncher" /tr "C:\Users\Admin\AppData\Roaming\WaveLauncher"
  2⤵
  - Creates scheduled task(s)
  PID:3032

C:\Windows\system32\taskeng.exe
taskeng.exe {E58E6D2D-C23A-4C4C-8DE7-D65644813C8B} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Users\Admin\AppData\Roaming\WaveLauncher
  C:\Users\Admin\AppData\Roaming\WaveLauncher
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1964
- C:\Users\Admin\AppData\Roaming\WaveLauncher
  C:\Users\Admin\AppData\Roaming\WaveLauncher
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1c79af53478cf007878e7b6ee72d295c

SHA1
319113fa6df2ed41cccfd8947fa6d15990fde471

SHA256
406494a001e1b360f25b255b0236c4a7c6488815b084732f2edb95214a025ecd

SHA512
dd9310d6f2a03966c22179b645b37524c7f0d1743a54da18db650da7bd68f5158fa280c1bb166de7fb7088ac1f561fdae412e4382de44856a9bb0ee23e13e27b

Download Submit
C:\Users\Admin\AppData\Roaming\WaveLauncher

Filesize
86KB

MD5
5cb8f4aa69339acc85ef9d2ca60b0c07

SHA1
bb12de5f0a59eda98ba82e4a81dd24d80b8d7844

SHA256
d8f968a5732220f35ab7094f13537d1d68405ed10362737848a87e5a71773e9d

SHA512
f8908f96cfff0498b977c2d790709cc02408068999f520a9727e3eff4e260092fd1c1b8fcf13d0cc217298f0e91a0b55fb30f88bba515fa08ed8b66465c07540

Download Submit
memory/1964-35-0x00000000000A0000-0x00000000000BC000-memory.dmp

Filesize
112KB

Download
memory/2172-30-0x000007FEF5F03000-0x000007FEF5F04000-memory.dmp

Filesize
4KB

Download
memory/2172-1-0x00000000002C0000-0x00000000002DC000-memory.dmp

Filesize
112KB

Download
memory/2172-39-0x0000000002120000-0x000000000212C000-memory.dmp

Filesize
48KB

Download
memory/2172-0-0x000007FEF5F03000-0x000007FEF5F04000-memory.dmp

Filesize
4KB

Download
memory/2172-31-0x000000001A880000-0x000000001A900000-memory.dmp

Filesize
512KB

Download
memory/2172-29-0x000000001A880000-0x000000001A900000-memory.dmp

Filesize
512KB

Download
memory/2276-7-0x000000001B360000-0x000000001B642000-memory.dmp

Filesize
2.9MB

Download
memory/2276-8-0x00000000024E0000-0x00000000024E8000-memory.dmp

Filesize
32KB

Download
memory/2276-6-0x00000000029D0000-0x0000000002A50000-memory.dmp

Filesize
512KB

Download
memory/2772-15-0x0000000002490000-0x0000000002498000-memory.dmp

Filesize
32KB

Download
memory/2772-14-0x000000001B330000-0x000000001B612000-memory.dmp

Filesize
2.9MB

Download
memory/2776-38-0x0000000001270000-0x000000000128C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads