Analysis
-
max time kernel
139s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30-05-2024 20:29
Static task
static1
Behavioral task
behavioral1
Sample
XwormLoader.exe
Resource
win7-20231129-en
General
-
Target
XwormLoader.exe
-
Size
7.8MB
-
MD5
f194b7e7fdbfe0fbf70673937337dc05
-
SHA1
ca1fb45e83d267ce039a4639181b5f790f5b3241
-
SHA256
3e4cbe1810496aff2ef544d0aa0b5f8d1c69e2a4e86c21921348ede7a9db3967
-
SHA512
d63a5d2c84b42944820622fae2bc1cb681ea1e709b9972c35bfca28e198bc18f86f63718b62e50aafa59005df13f2d0f6edd017947133a2cd53688a7cd5844e2
-
SSDEEP
196608:W7b4C6XrL5HfZBEhl3xZi5OslC9+PWbXooVl41u1mMFsr5:W7yvRZBEP3xZi5Oso+PWbXooL4Sa
Malware Config
Signatures
-
Detect Xworm Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\svchost.exe family_xworm behavioral2/memory/2900-16-0x0000000000470000-0x000000000049A000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 4952 powershell.exe 3720 powershell.exe 4424 powershell.exe 4888 powershell.exe -
.NET Reactor proctector 2 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\svchost.exe net_reactor behavioral2/memory/2900-16-0x0000000000470000-0x000000000049A000-memory.dmp net_reactor -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
XwormLoader.exesvchost.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation XwormLoader.exe Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation svchost.exe -
Executes dropped EXE 5 IoCs
Processes:
svchost.exeXworm V5.6.exesvchost.exesvchost.exesvchost.exepid process 2900 svchost.exe 2424 Xworm V5.6.exe 4672 svchost.exe 3140 svchost.exe 4064 svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3140 timeout.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
svchost.exepid process 2900 svchost.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exesvchost.exepid process 4888 powershell.exe 4888 powershell.exe 4952 powershell.exe 4952 powershell.exe 3720 powershell.exe 3720 powershell.exe 4424 powershell.exe 4424 powershell.exe 2900 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
svchost.exepowershell.exepowershell.exepowershell.exepowershell.exesvchost.exesvchost.exesvchost.exedescription pid process Token: SeDebugPrivilege 2900 svchost.exe Token: SeDebugPrivilege 4888 powershell.exe Token: SeDebugPrivilege 4952 powershell.exe Token: SeDebugPrivilege 3720 powershell.exe Token: SeDebugPrivilege 4424 powershell.exe Token: SeDebugPrivilege 4672 svchost.exe Token: SeDebugPrivilege 3140 svchost.exe Token: SeDebugPrivilege 4064 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
svchost.exepid process 2900 svchost.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
XwormLoader.execmd.exesvchost.exedescription pid process target process PID 2976 wrote to memory of 2900 2976 XwormLoader.exe svchost.exe PID 2976 wrote to memory of 2900 2976 XwormLoader.exe svchost.exe PID 2976 wrote to memory of 2424 2976 XwormLoader.exe Xworm V5.6.exe PID 2976 wrote to memory of 2424 2976 XwormLoader.exe Xworm V5.6.exe PID 2976 wrote to memory of 2356 2976 XwormLoader.exe cmd.exe PID 2976 wrote to memory of 2356 2976 XwormLoader.exe cmd.exe PID 2356 wrote to memory of 3140 2356 cmd.exe timeout.exe PID 2356 wrote to memory of 3140 2356 cmd.exe timeout.exe PID 2900 wrote to memory of 4888 2900 svchost.exe powershell.exe PID 2900 wrote to memory of 4888 2900 svchost.exe powershell.exe PID 2900 wrote to memory of 4952 2900 svchost.exe powershell.exe PID 2900 wrote to memory of 4952 2900 svchost.exe powershell.exe PID 2900 wrote to memory of 3720 2900 svchost.exe powershell.exe PID 2900 wrote to memory of 3720 2900 svchost.exe powershell.exe PID 2900 wrote to memory of 4424 2900 svchost.exe powershell.exe PID 2900 wrote to memory of 4424 2900 svchost.exe powershell.exe PID 2900 wrote to memory of 4756 2900 svchost.exe schtasks.exe PID 2900 wrote to memory of 4756 2900 svchost.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4888
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4952
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svchost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3720
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4424
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\ProgramData\svchost.exe"3⤵
- Creates scheduled task(s)
PID:4756
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"2⤵
- Executes dropped EXE
PID:2424
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4C1C.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:3140
-
-
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4672
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3140
-
C:\ProgramData\svchost.exeC:\ProgramData\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4064
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
944B
MD522310ad6749d8cc38284aa616efcd100
SHA1440ef4a0a53bfa7c83fe84326a1dff4326dcb515
SHA25655b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf
SHA5122ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def
-
Filesize
944B
MD5c28937317ffaecb0023533dc0069808d
SHA19f5175aeaf73db5ab967b57bd896a982a9c6e906
SHA256f6cb138382b9333938304b47ca2fcab5d9fa5c3fa63665020872c49a5d7bd7a9
SHA5122de2e86570c35021f4fecd1e9fec285d410d8e36fce3ef4d782ff8c7d43242f10de123dac7e1c0609c27f33e6b88c46d83bc47948ca0b0329ca0ba70a5105ce4
-
Filesize
14.9MB
MD5db51a102eab752762748a2dec8f7f67a
SHA1194688ec1511b83063f7b0167ae250764b7591d1
SHA25693e5e7f018053c445c521b010caff89e61f61743635db3500aad32d6e495abb2
SHA512fb2fb6605a17fedb65e636cf3716568e85b8ea423c23e0513eb87f3a3441e2cabc4c3e6346225a9bf7b81e97470f3ab516feea649a7afb5cdf02faff8d7f09a5
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
144KB
MD54b90399888a12fb85ccc3d0190d5a1d3
SHA13326c027bac28b9480b0c7f621481a6cc033db4e
SHA256cede03d0ef98d200bd5b68f6ca4e0d74e2a62fc430a38083663c3031dbb1c77f
SHA512899ec2df2f5d70716ad5d0686bfe0a6c66ccbcf7f0485efbdfc0615f90b3526cd3d31069fa66c7c6ae8bba6ce92200836c50da40a3731888b7326b970d93216a
-
Filesize
163B
MD5552452127e0c6093aed4e8df03e2e0c5
SHA19e9ede5b672db9944836fc5614b019fc746cb583
SHA256cee50110be6c8b322a7e1370495919f89787fca2bd5f0047b0bb503cb1cecfc1
SHA51218971db8b52ee4fd1b68791718d368c95749e42830f55d88426ee1ae1efbc9f9b1565ed88014f7deb61d56a3a176b84af34b3fe1461fb538ecc0ac1591b134b4