xworm | 94b65da2b5cc3728547f892a46e9c48c5d54477d10ea8e210304593acd3568e7 | Triage

Analysis

max time kernel
1796s
max time network
1800s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
30-05-2024 20:08

Sharing

Report Analysis Logs

General

Target

XClient.exe
Size

59KB
MD5

d172c0a4ae3e8cef6a0a910bde62e195
SHA1

51139fc633fe81a66c8ed55081f92ec5256bd0bd
SHA256

94b65da2b5cc3728547f892a46e9c48c5d54477d10ea8e210304593acd3568e7
SHA512

d82c930a42fd623aeee51007453d201e96110b546f1fb34080fc6d4c1488d71b3828f5f1833d347993444e4d332aa00fbb7b8922fce676d220375470ad0fa467
SSDEEP

1536:9vv68xQQodoW8YTK6uDkbrfSVxwXSOqQ+k:1vjWQoGJYTK6CkbrfHSOqQ+k

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

length-desert.gl.at.ply.gg:58023

%AppData%:9

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/memory/3336-1-0x00000000000E0000-0x00000000000F6000-memory.dmp	family_xworm
behavioral1/files/0x000900000001ab65-7.dat	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9.lnk	XClient.exe

Executes dropped EXE 30 IoCs

pid	Process
2216	9
2200	9
3940	9
704	9
1968	9
2204	9
2160	9
1800	9
2952	9
4844	9
4876	9
3976	9
772	9
1792	9
1512	9
2140	9
1036	9
4068	9
824	9
1448	9
2076	9
4888	9
5108	9
2912	9
5076	9
560	9
3880	9
1380	9
2036	9
2560	9

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\9 = "C:\\Users\\Admin\\AppData\\Roaming\\9"	XClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task/Job

pid	Process
4668	schtasks.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	3336	XClient.exe
Token: SeDebugPrivilege	3336	XClient.exe
Token: SeDebugPrivilege	2216	9
Token: SeDebugPrivilege	2200	9
Token: SeDebugPrivilege	3940	9
Token: SeDebugPrivilege	704	9
Token: SeDebugPrivilege	1968	9
Token: SeDebugPrivilege	2204	9
Token: SeDebugPrivilege	2160	9
Token: SeDebugPrivilege	1800	9
Token: SeDebugPrivilege	2952	9
Token: SeDebugPrivilege	4844	9
Token: SeDebugPrivilege	4876	9
Token: SeDebugPrivilege	3976	9
Token: SeDebugPrivilege	772	9
Token: SeDebugPrivilege	1792	9
Token: SeDebugPrivilege	1512	9
Token: SeDebugPrivilege	2140	9
Token: SeDebugPrivilege	1036	9
Token: SeDebugPrivilege	4068	9
Token: SeDebugPrivilege	824	9
Token: SeDebugPrivilege	1448	9
Token: SeDebugPrivilege	2076	9
Token: SeDebugPrivilege	4888	9
Token: SeDebugPrivilege	5108	9
Token: SeDebugPrivilege	2912	9
Token: SeDebugPrivilege	5076	9
Token: SeDebugPrivilege	560	9
Token: SeDebugPrivilege	3880	9
Token: SeDebugPrivilege	1380	9
Token: SeDebugPrivilege	2036	9
Token: SeDebugPrivilege	2560	9

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 4668	3336	XClient.exe	73
PID 3336 wrote to memory of 4668	3336	XClient.exe	73

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "9" /tr "C:\Users\Admin\AppData\Roaming\9"
  2⤵
  - Creates scheduled task(s)
  PID:4668

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2216

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2200

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3940

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:704

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1968

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2204

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2160

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1800

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2952

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4844

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3976

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:772

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1792

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1512

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2140

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1036

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4068

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:824

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1448

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2076

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4888

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5108

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2912

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5076

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:560

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3880

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1380

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2036

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\9.log

Filesize
654B

MD5
16c5fce5f7230eea11598ec11ed42862

SHA1
75392d4824706090f5e8907eee1059349c927600

SHA256
87ba77c13905298acbac72be90949c4fe0755b6eff9777615aa37f252515f151

SHA512
153edd6da59beea6cc411ed7383c32916425d6ebb65f04c65aab7c1d6b25443d143aa8449aa92149de0ad8a975f6ecaa60f9f7574536eec6b38fe5fd3a6c6adc

Download Submit
C:\Users\Admin\AppData\Roaming\9

Filesize
59KB

MD5
d172c0a4ae3e8cef6a0a910bde62e195

SHA1
51139fc633fe81a66c8ed55081f92ec5256bd0bd

SHA256
94b65da2b5cc3728547f892a46e9c48c5d54477d10ea8e210304593acd3568e7

SHA512
d82c930a42fd623aeee51007453d201e96110b546f1fb34080fc6d4c1488d71b3828f5f1833d347993444e4d332aa00fbb7b8922fce676d220375470ad0fa467

Download Submit
memory/2216-9-0x00007FF9E08B0000-0x00007FF9E129C000-memory.dmp

Filesize
9.9MB

Download
memory/2216-11-0x00007FF9E08B0000-0x00007FF9E129C000-memory.dmp

Filesize
9.9MB

Download
memory/3336-0-0x00007FF9E08B3000-0x00007FF9E08B4000-memory.dmp

Filesize
4KB

Download
memory/3336-1-0x00000000000E0000-0x00000000000F6000-memory.dmp

Filesize
88KB

Download
memory/3336-5-0x00007FF9E08B0000-0x00007FF9E129C000-memory.dmp

Filesize
9.9MB

Download
memory/3336-6-0x00007FF9E08B0000-0x00007FF9E129C000-memory.dmp

Filesize
9.9MB

Download