xworm | 94b65da2b5cc3728547f892a46e9c48c5d54477d10ea8e210304593acd3568e7 | Triage

Analysis

max time kernel
1795s
max time network
1799s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
30/05/2024, 20:08

Sharing

Report Analysis Logs

General

Target

XClient.exe
Size

59KB
MD5

d172c0a4ae3e8cef6a0a910bde62e195
SHA1

51139fc633fe81a66c8ed55081f92ec5256bd0bd
SHA256

94b65da2b5cc3728547f892a46e9c48c5d54477d10ea8e210304593acd3568e7
SHA512

d82c930a42fd623aeee51007453d201e96110b546f1fb34080fc6d4c1488d71b3828f5f1833d347993444e4d332aa00fbb7b8922fce676d220375470ad0fa467
SSDEEP

1536:9vv68xQQodoW8YTK6uDkbrfSVxwXSOqQ+k:1vjWQoGJYTK6CkbrfHSOqQ+k

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

length-desert.gl.at.ply.gg:58023

%AppData%:9

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral4/memory/3476-1-0x0000000000D60000-0x0000000000D76000-memory.dmp	family_xworm
behavioral4/files/0x000800000002a9bd-6.dat	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9.lnk	XClient.exe

Executes dropped EXE 30 IoCs

pid	Process
3100	9
4316	9
692	9
4468	9
804	9
1780	9
4092	9
1400	9
544	9
4392	9
4388	9
4660	9
5056	9
3164	9
1360	9
2208	9
1064	9
3380	9
1068	9
3580	9
1076	9
2024	9
4316	9
4884	9
1004	9
2056	9
4428	9
4856	9
1184	9
4076	9

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Microsoft\Windows\CurrentVersion\Run\9 = "C:\\Users\\Admin\\AppData\\Roaming\\9"	XClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task/Job

pid	Process
1864	schtasks.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	3476	XClient.exe
Token: SeDebugPrivilege	3476	XClient.exe
Token: SeDebugPrivilege	3100	9
Token: SeDebugPrivilege	4316	9
Token: SeDebugPrivilege	692	9
Token: SeDebugPrivilege	4468	9
Token: SeDebugPrivilege	804	9
Token: SeDebugPrivilege	1780	9
Token: SeDebugPrivilege	4092	9
Token: SeDebugPrivilege	1400	9
Token: SeDebugPrivilege	544	9
Token: SeDebugPrivilege	4392	9
Token: SeDebugPrivilege	4388	9
Token: SeDebugPrivilege	4660	9
Token: SeDebugPrivilege	5056	9
Token: SeDebugPrivilege	3164	9
Token: SeDebugPrivilege	1360	9
Token: SeDebugPrivilege	2208	9
Token: SeDebugPrivilege	1064	9
Token: SeDebugPrivilege	3380	9
Token: SeDebugPrivilege	1068	9
Token: SeDebugPrivilege	3580	9
Token: SeDebugPrivilege	1076	9
Token: SeDebugPrivilege	2024	9
Token: SeDebugPrivilege	4316	9
Token: SeDebugPrivilege	4884	9
Token: SeDebugPrivilege	1004	9
Token: SeDebugPrivilege	2056	9
Token: SeDebugPrivilege	4428	9
Token: SeDebugPrivilege	4856	9
Token: SeDebugPrivilege	1184	9
Token: SeDebugPrivilege	4076	9

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 1864	3476	XClient.exe	76
PID 3476 wrote to memory of 1864	3476	XClient.exe	76

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "9" /tr "C:\Users\Admin\AppData\Roaming\9"
  2⤵
  - Creates scheduled task(s)
  PID:1864

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3100

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4316

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:692

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4468

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:804

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1780

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4092

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1400

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:544

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4392

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4388

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4660

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5056

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3164

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1360

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2208

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1064

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3380

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1068

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3580

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1076

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2024

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4316

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4884

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1004

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2056

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4428

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4856

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1184

C:\Users\Admin\AppData\Roaming\9
C:\Users\Admin\AppData\Roaming\9
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\9.log

Filesize
654B

MD5
2cbbb74b7da1f720b48ed31085cbd5b8

SHA1
79caa9a3ea8abe1b9c4326c3633da64a5f724964

SHA256
e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

SHA512
ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

Download Submit
C:\Users\Admin\AppData\Roaming\9

Filesize
59KB

MD5
d172c0a4ae3e8cef6a0a910bde62e195

SHA1
51139fc633fe81a66c8ed55081f92ec5256bd0bd

SHA256
94b65da2b5cc3728547f892a46e9c48c5d54477d10ea8e210304593acd3568e7

SHA512
d82c930a42fd623aeee51007453d201e96110b546f1fb34080fc6d4c1488d71b3828f5f1833d347993444e4d332aa00fbb7b8922fce676d220375470ad0fa467

Download Submit
memory/3100-8-0x00007FFEBB1D0000-0x00007FFEBBC92000-memory.dmp

Filesize
10.8MB

Download
memory/3100-10-0x00007FFEBB1D0000-0x00007FFEBBC92000-memory.dmp

Filesize
10.8MB

Download
memory/3476-0-0x00007FFEBB1D3000-0x00007FFEBB1D5000-memory.dmp

Filesize
8KB

Download
memory/3476-1-0x0000000000D60000-0x0000000000D76000-memory.dmp

Filesize
88KB

Download
memory/3476-5-0x00007FFEBB1D0000-0x00007FFEBBC92000-memory.dmp

Filesize
10.8MB

Download
memory/3476-11-0x00007FFEBB1D3000-0x00007FFEBB1D5000-memory.dmp

Filesize
8KB

Download
memory/3476-12-0x00007FFEBB1D0000-0x00007FFEBBC92000-memory.dmp

Filesize
10.8MB

Download