xworm | 94b65da2b5cc3728547f892a46e9c48c5d54477d10ea8e210304593acd3568e7

General

Target
XClient.exe
Size 59KB
Sample240530-ywvecaha9z
SHA256 94b65da2b5cc3728547f892a46e9c48c5d54477d10ea8e210304593acd3568e7
MD5 d172c0a4ae3e8cef6a0a910bde62e195
SHA1 51139fc633fe81a66c8ed55081f92ec5256bd0bd
SHA512 d82c930a42fd623aeee51007453d201e96110b546f1fb34080fc6d4c1488d71b3828f5f1833d347993444e4d332aa00fbb7b8922fce676d220375470ad0fa467
SSDEEP 1536:9vv68xQQodoW8YTK6uDkbrfSVxwXSOqQ+k:1vjWQoGJYTK6CkbrfHSOqQ+k
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

length-desert.gl.at.ply.gg:58023
%AppData%:9

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral3/memory/4308-1-0x0000000000FE0000-0x0000000000FF6000-memory.dmp	family_xworm
behavioral3/files/0x00070000000233c7-8.dat	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	XClient.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9.lnk	XClient.exe

Executes dropped EXE 30 IoCs

pid	Process
4736	9
3976	9
4316	9
2412	9
4736	9
4464	9
5096	9
3936	9
4344	9
3236	9
3192	9
5044	9
4648	9
60	9
2244	9
1128	9
3296	9
3704	9
4784	9
4496	9
840	9
1796	9
4964	9
1008	9
4800	9
4448	9
4344	9
4852	9
2256	9
4420	9

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9 = "C:\\Users\\Admin\\AppData\\Roaming\\9"	XClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2280	schtasks.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	4308	XClient.exe
Token: SeDebugPrivilege	4308	XClient.exe
Token: SeDebugPrivilege	4736	9
Token: SeDebugPrivilege	3976	9
Token: SeDebugPrivilege	4316	9
Token: SeDebugPrivilege	2412	9
Token: SeDebugPrivilege	4736	9
Token: SeDebugPrivilege	4464	9
Token: SeDebugPrivilege	5096	9
Token: SeDebugPrivilege	3936	9
Token: SeDebugPrivilege	4344	9
Token: SeDebugPrivilege	3236	9
Token: SeDebugPrivilege	3192	9
Token: SeDebugPrivilege	5044	9
Token: SeDebugPrivilege	4648	9
Token: SeDebugPrivilege	60	9
Token: SeDebugPrivilege	2244	9
Token: SeDebugPrivilege	1128	9
Token: SeDebugPrivilege	3296	9
Token: SeDebugPrivilege	3704	9
Token: SeDebugPrivilege	4784	9
Token: SeDebugPrivilege	4496	9
Token: SeDebugPrivilege	840	9
Token: SeDebugPrivilege	1796	9
Token: SeDebugPrivilege	4964	9
Token: SeDebugPrivilege	1008	9
Token: SeDebugPrivilege	4800	9
Token: SeDebugPrivilege	4448	9
Token: SeDebugPrivilege	4344	9
Token: SeDebugPrivilege	4852	9
Token: SeDebugPrivilege	2256	9
Token: SeDebugPrivilege	4420	9

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 2280	4308	XClient.exe	86
PID 4308 wrote to memory of 2280	4308	XClient.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "9" /tr "C:\Users\Admin\AppData\Roaming\9"
  2⤵
  - Creates scheduled task(s)
  PID:2280

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4736

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3976

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4316

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2412

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4736

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4464

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5096

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3936

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4344

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3236

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3192

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5044

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4648

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:60

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2244

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1128

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3296

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3704

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4784

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4496

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:840

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1796

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4964

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1008

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4800

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4448

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4344

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2256

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\9.log
Size 654B
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
MD5 SHA1 SHA512

Submit Download

9

Path C:\Users\Admin\AppData\Roaming\9
Size 59KB
SHA256 94b65da2b5cc3728547f892a46e9c48c5d54477d10ea8e210304593acd3568e7
MD5 d172c0a4ae3e8cef6a0a910bde62e195
SHA1 51139fc633fe81a66c8ed55081f92ec5256bd0bd
SHA512 d82c930a42fd623aeee51007453d201e96110b546f1fb34080fc6d4c1488d71b3828f5f1833d347993444e4d332aa00fbb7b8922fce676d220375470ad0fa467
SSDEEP 1536:9vv68xQQodoW8YTK6uDkbrfSVxwXSOqQ+k:1vjWQoGJYTK6CkbrfHSOqQ+k
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4308-0-0x00007FF9F8B43000-0x00007FF9F8B45000-memory.dmp

Download

memory/4308-1-0x0000000000FE0000-0x0000000000FF6000-memory.dmp

Download

memory/4308-5-0x00007FF9F8B40000-0x00007FF9F9601000-memory.dmp

Download

memory/4308-6-0x00007FF9F8B43000-0x00007FF9F8B45000-memory.dmp

Download

memory/4308-7-0x00007FF9F8B40000-0x00007FF9F9601000-memory.dmp

Download

memory/4736-10-0x00007FF9F8B40000-0x00007FF9F9601000-memory.dmp

Download

memory/4736-12-0x00007FF9F8B40000-0x00007FF9F9601000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads