xworm | e03842270991c28c9dc59f1a3fd4bba0883fc03d51fd8e64e02c47a324ea6db9

Analysis

max time kernel
299s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 01:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XClient.exe
Size 72KB
Sample240530-b59t3aaa7v
SHA256 e03842270991c28c9dc59f1a3fd4bba0883fc03d51fd8e64e02c47a324ea6db9
MD5 4687edb47f66c42395805ab5d1c005c1
SHA1 5e73b1ee9bd8ece54ac0f49266dcf15a901a52bd
SHA512 8d8995a780088b6948c59eb346943d3bb5889f36e9a28b01a047fbf330a919b5d8f5f561604eef8ddaefd62b056508b8bf5bb8de971cd06bc5a8323cb942187c
SSDEEP 1536:B1BXExLk4h7lc2NVRNqrwnK+bdfLxvn2Hq6O6s5JFpETk:B14XhysDNqrb+bdftAq6O6yJFpYk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

127.0.0.1:2421
tel-form.gl.at.ply.gg:2421

Attributes

Install_directory
%AppData%
install_file
discord.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/996-1-0x00000000001C0000-0x00000000001D8000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	XClient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	byiitd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.lnk	XClient.exe

Executes dropped EXE 2 IoCs

pid	Process
2128	byiitd.exe
776	Курсор - писюн.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\discord = "C:\\Users\\Admin\\AppData\\Roaming\\discord.exe"	XClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	XClient.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4524	vlc.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
996	XClient.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4524	vlc.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	996	XClient.exe
Token: SeDebugPrivilege	996	XClient.exe
Token: 33	1360	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1360	AUDIODG.EXE
Token: 33	4524	vlc.exe
Token: SeIncBasePriorityPrivilege	4524	vlc.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
4524	vlc.exe
4524	vlc.exe
4524	vlc.exe
4524	vlc.exe
4524	vlc.exe
4524	vlc.exe
4524	vlc.exe
4524	vlc.exe
4524	vlc.exe
4524	vlc.exe
4524	vlc.exe
4524	vlc.exe
4524	vlc.exe
4524	vlc.exe
4524	vlc.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
4524	vlc.exe
4524	vlc.exe
4524	vlc.exe
4524	vlc.exe
4524	vlc.exe
4524	vlc.exe
4524	vlc.exe
4524	vlc.exe
4524	vlc.exe
4524	vlc.exe
4524	vlc.exe
4524	vlc.exe
4524	vlc.exe
4524	vlc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
996	XClient.exe
4524	vlc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 2128	996	XClient.exe	92
PID 996 wrote to memory of 2128	996	XClient.exe	92
PID 996 wrote to memory of 2128	996	XClient.exe	92
PID 2128 wrote to memory of 776	2128	byiitd.exe	93
PID 2128 wrote to memory of 776	2128	byiitd.exe	93
PID 2128 wrote to memory of 776	2128	byiitd.exe	93
PID 996 wrote to memory of 4524	996	XClient.exe	96
PID 996 wrote to memory of 4524	996	XClient.exe	96

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996
- C:\Users\Admin\AppData\Local\Temp\byiitd.exe
  "C:\Users\Admin\AppData\Local\Temp\byiitd.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\Курсор - писюн.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Курсор - писюн.exe"
    3⤵
    - Executes dropped EXE
    PID:776
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\esycdv.mp3"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4524

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x300 0x34c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xui2.cur

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\xui2.cur
Size 4KB
SHA256 de7c8bd93cc576d719805835099ae0f2cb88d797fe71585e2f7eb56b67a8fb72
MD5 c1fd2feb9e2b56be00082dd06c2b9658
SHA1 6e9272d5d53272f901ebb75ea556e250d4fc54aa
SHA512 7530ad40f0adc93d5166b2b4741ba66bc5792ca1882be658b86b290feaa3ccf08f15ef0d55cc40494c6f3fedb78ecc5dab2a5342e0bdc85a068a3a0ffdc6e79a
SSDEEP 24:DeoFGmUIE7rhudgnvG256A+4Fu86wtBR/lFKJXi07QtfsrbjRnK6I6yK:CoF2nhRnvG25r+41BRlu0tfs/jlK6I3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

Курсор - писюн.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Курсор - писюн.exe
Size 5KB
SHA256 e60353b37f785c77e1063ac44cba792e9ec69f27b1dc9f3b719280d5ce015cc0
MD5 17b935ed6066732a76bed69867702e4b
SHA1 23f28e3374f9d0e03d45843b28468aace138e71c
SHA512 774ea047cdc5f008df03ad67242df04d630bb962bc99f1ea8974a21baf6a902c7a5d8b8d09d9e5c7d7e46b0378c7baf33bf80fb3e34777cd0958b8fc740d0318
SSDEEP 96:2AY3+z86Wt3VGEwMO54w802Sug8kiBzNt:FYe86WGhMO54w81jJD
MD5 SHA1 SHA512 SSDEEP

Submit Download

byiitd.exe

Path C:\Users\Admin\AppData\Local\Temp\byiitd.exe
Size 317KB
SHA256 507895a5170319193ced89311753529812a26b344213d44c92a988e3b4c99c06
MD5 00e82a1db301ab77338b0a4863e2e1ad
SHA1 7a4a23a285eb1c4ef1b39124ff125eb095c73bc4
SHA512 745c1f07f194c48938a77c3879b05eec566f8a1a15a75099e31782faeea087a4c488ef3693de08f66735f464784b22b3c14ff0ac85284e412c35e4e0741ce8ef
SSDEEP 3072:/nWSR+jounK7NAKDjiBmKbOUEuQvS/bcwWE2wup3vMRU6RLvHEd9VhMCyqKbv83G:+TouKrWBEu3/Z2lpGDHU3ykJyT+tjs/n
MD5 SHA1 SHA512 SSDEEP

Submit Download

esycdv.mp3

Path C:\Users\Admin\AppData\Local\Temp\esycdv.mp3
Size 30KB
SHA256 db25c4b7003bf451da19c9e2609c5e8b1a2315d0dac35d9d2195a02750460f81
MD5 d2b247c97d062f9b481c20a2e785fcdc
SHA1 3701f483c83318bec044c01f5c48a29a244af3a2
SHA512 b86691126dc8d0e603dc7643e1d90a37c138644670c02641df06535fb9f3f4b8629037af94a1c37020d2ec34ebab4da9a314dcc2832b8f8f745f04f428aac2c3
SSDEEP 384:/8AZ27m5cJXpeNWsIvF5q3vXMVww/f8iOjEJD0TQIQQovX:NZsKIsIvFZewX8BQ+TvQRvX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/776-33-0x00000000001C0000-0x00000000001C8000-memory.dmp

Download

memory/996-0-0x00007FF950993000-0x00007FF950995000-memory.dmp

Download

memory/996-1-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/996-6-0x00007FF950990000-0x00007FF951451000-memory.dmp

Download

memory/996-7-0x00007FF950993000-0x00007FF950995000-memory.dmp

Download

memory/996-8-0x00007FF950990000-0x00007FF951451000-memory.dmp

Download

memory/996-9-0x0000000002280000-0x000000000228C000-memory.dmp

Download

memory/4524-55-0x00007FF961250000-0x00007FF96126D000-memory.dmp

Download

memory/4524-62-0x00007FF960B70000-0x00007FF960B81000-memory.dmp

Download

memory/4524-52-0x00007FF965170000-0x00007FF965181000-memory.dmp

Download

memory/4524-56-0x00007FF960C50000-0x00007FF960C61000-memory.dmp

Download

memory/4524-57-0x00007FF94CEE0000-0x00007FF94D0EB000-memory.dmp

Download

memory/4524-47-0x00007FF60F9B0000-0x00007FF60FAA8000-memory.dmp

Download

memory/4524-64-0x00007FF960990000-0x00007FF9609A1000-memory.dmp

Download

memory/4524-63-0x00007FF9609B0000-0x00007FF9609C1000-memory.dmp

Download

memory/4524-61-0x00007FF960BB0000-0x00007FF960BC8000-memory.dmp

Download

memory/4524-60-0x00007FF960BD0000-0x00007FF960BF1000-memory.dmp

Download

memory/4524-59-0x00007FF960C00000-0x00007FF960C41000-memory.dmp

Download

memory/4524-48-0x00007FF9651B0000-0x00007FF9651E4000-memory.dmp

Download

memory/4524-54-0x00007FF9650F0000-0x00007FF965101000-memory.dmp

Download

memory/4524-49-0x00007FF94D580000-0x00007FF94D836000-memory.dmp

Download

memory/4524-53-0x00007FF965110000-0x00007FF965127000-memory.dmp

Download

memory/4524-51-0x00007FF965190000-0x00007FF9651A7000-memory.dmp

Download

memory/4524-50-0x00007FF967B90000-0x00007FF967BA8000-memory.dmp

Download

memory/4524-58-0x00007FF946760000-0x00007FF947810000-memory.dmp

Download

memory/4524-65-0x00007FF944690000-0x00007FF945EFF000-memory.dmp

Download

memory/4524-77-0x00007FF946760000-0x00007FF947810000-memory.dmp

Download

memory/4524-96-0x00007FF946760000-0x00007FF947810000-memory.dmp

Download