xworm | cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 01:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe
Size 509KB
Sample240531-b2dmfsbe28
SHA256 cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651
MD5 ff3aea929347d0168b02de5d2c2bcec3
SHA1 fd7eaa628f424fc1384bcbd926a551c8e60740db
SHA512 c5ba038472b25fa013852b57fa712a286e56a85f015b68c5e7da72ed403aa0b896deb6583407894ae76dc59e90c475a161504d55202b4b7fe774732b22793c3b
SSDEEP 12288:lUrKkGdrJwKcItNXOMaFshRSxD1ulXrvNE53jHd:DcA9NEQlXTaT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

104.250.180.178:7061

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/676-10-0x0000000000400000-0x0000000000414000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral2/memory/676-10-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1636	powershell.exe
3224	powershell.exe
4356	powershell.exe
712	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 764 set thread context of 676	764	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1636	powershell.exe
1636	powershell.exe
3224	powershell.exe
3224	powershell.exe
4356	powershell.exe
4356	powershell.exe
712	powershell.exe
712	powershell.exe
676	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	676	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe
Token: SeDebugPrivilege	1636	powershell.exe
Token: SeDebugPrivilege	3224	powershell.exe
Token: SeDebugPrivilege	4356	powershell.exe
Token: SeDebugPrivilege	712	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
676	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 676	764	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	93
PID 764 wrote to memory of 676	764	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	93
PID 764 wrote to memory of 676	764	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	93
PID 764 wrote to memory of 676	764	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	93
PID 764 wrote to memory of 676	764	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	93
PID 764 wrote to memory of 676	764	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	93
PID 764 wrote to memory of 676	764	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	93
PID 764 wrote to memory of 676	764	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	93
PID 676 wrote to memory of 1636	676	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	94
PID 676 wrote to memory of 1636	676	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	94
PID 676 wrote to memory of 1636	676	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	94
PID 676 wrote to memory of 3224	676	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	96
PID 676 wrote to memory of 3224	676	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	96
PID 676 wrote to memory of 3224	676	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	96
PID 676 wrote to memory of 4356	676	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	98
PID 676 wrote to memory of 4356	676	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	98
PID 676 wrote to memory of 4356	676	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	98
PID 676 wrote to memory of 712	676	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	100
PID 676 wrote to memory of 712	676	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	100
PID 676 wrote to memory of 712	676	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	100

C:\Users\Admin\AppData\Local\Temp\cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe
"C:\Users\Admin\AppData\Local\Temp\cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:764
- C:\Users\Admin\AppData\Local\Temp\cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe
  "C:\Users\Admin\AppData\Local\Temp\cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:676
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1636
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3224
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4356
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 2a97a665cc13a0cbe7f17058775b6bf74bb82c256b135b4ef3c5d0efad868ea6
MD5 155693d37a2ef32e6370db6e1d60ff62
SHA1 769f536a50c8bc7a7f699104a68bb6277be521a9
SHA512 642155820a65af5c70cc099e959ad75c168841f0daa68b6430699d4e8b9b07df1393d9733693d2f122985a3555fb2433231b95963ae7b20d9456d3ca887e1b0f
SSDEEP 384:Vsf+BX99100DGYoooRJkOdGllNY1qM+0ioZ+dIJ7L+nUKVkki0SO1:Kfe00WoowOilNflxdIJ2UKiki0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 827761d4f5f4d588912d0918989032df66d026204364abed3c8fff3570e776d2
MD5 a1b7deab00b9e3ac4e4d32a28767e0f5
SHA1 02e4a350ae521d57eae3c1b87e19dc718cd18853
SHA512 2d42c5075997f80527e485d9d77093f538f9d71db33d01aecc535635c65f63f00627263a5278b47ac0c25c07e11b5b6c68216846751f8884bd2617da77ffa4e0
SSDEEP 384:Bsf+BI9i+4BPN5WmloizJk+o9o2TVK6seYwME/l03SoZdfYSgcjEDkyQ0gdEtkKF:mfWBTWiXejo2TVNfrOSwWCED/Ce3
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 16129b44ae22e4e485f8f5e7be54948f22125d8520a94dcd74606dec0c3484f8
MD5 cb510602161d9da8cf34c4269fd58305
SHA1 5897db5829282cc736f9c85d67ce4892dfe84c5e
SHA512 5dab5cf64f2e742a4e5f3eb5b724483629ee85af0aaa04f499f2786acce31da739aa861f46a26a79699873d88f281afe682ea99577820f4178fb5a5201b96277
SSDEEP 384:asf+Bl91N9BsnQXIoJkmYcc+JY1fV/G3opz+dIpX7L+nRVkki0SO1:nfON92Q4JmRc+JUV6xdIJ2Riki0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_oohhi4qt.z3y.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oohhi4qt.z3y.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/676-126-0x0000000074610000-0x0000000074DC0000-memory.dmp

Download

memory/676-127-0x0000000074610000-0x0000000074DC0000-memory.dmp

Download

memory/676-128-0x0000000074610000-0x0000000074DC0000-memory.dmp

Download

memory/676-12-0x0000000074610000-0x0000000074DC0000-memory.dmp

Download

memory/676-10-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/712-111-0x000000006FC30000-0x000000006FC7C000-memory.dmp

Download

memory/764-9-0x0000000006960000-0x00000000069B6000-memory.dmp

Download

memory/764-8-0x0000000006740000-0x0000000006750000-memory.dmp

Download

memory/764-13-0x0000000074610000-0x0000000074DC0000-memory.dmp

Download

memory/764-7-0x0000000006D60000-0x0000000006D78000-memory.dmp

Download

memory/764-6-0x0000000074610000-0x0000000074DC0000-memory.dmp

Download

memory/764-0-0x000000007461E000-0x000000007461F000-memory.dmp

Download

memory/764-5-0x00000000055A0000-0x000000000563C000-memory.dmp

Download

memory/764-4-0x00000000054D0000-0x00000000054DA000-memory.dmp

Download

memory/764-3-0x0000000005410000-0x00000000054A2000-memory.dmp

Download

memory/764-2-0x00000000058E0000-0x0000000005E84000-memory.dmp

Download

memory/764-1-0x00000000009B0000-0x0000000000A34000-memory.dmp

Download

memory/1636-33-0x0000000006F40000-0x0000000006F72000-memory.dmp

Download

memory/1636-53-0x0000000007FE0000-0x0000000007FFA000-memory.dmp

Download

memory/1636-31-0x0000000006970000-0x000000000698E000-memory.dmp

Download

memory/1636-34-0x000000006FC30000-0x000000006FC7C000-memory.dmp

Download

memory/1636-44-0x0000000006F80000-0x0000000006F9E000-memory.dmp

Download

memory/1636-45-0x0000000007960000-0x0000000007A03000-memory.dmp

Download

memory/1636-46-0x00000000082E0000-0x000000000895A000-memory.dmp

Download

memory/1636-47-0x0000000007CA0000-0x0000000007CBA000-memory.dmp

Download

memory/1636-48-0x0000000007D10000-0x0000000007D1A000-memory.dmp

Download

memory/1636-49-0x0000000007F20000-0x0000000007FB6000-memory.dmp

Download

memory/1636-50-0x0000000007EA0000-0x0000000007EB1000-memory.dmp

Download

memory/1636-51-0x0000000007ED0000-0x0000000007EDE000-memory.dmp

Download

memory/1636-52-0x0000000007EE0000-0x0000000007EF4000-memory.dmp

Download

memory/1636-32-0x00000000069A0000-0x00000000069EC000-memory.dmp

Download

memory/1636-54-0x0000000007FC0000-0x0000000007FC8000-memory.dmp

Download

memory/1636-57-0x0000000074610000-0x0000000074DC0000-memory.dmp

Download

memory/1636-30-0x0000000006460000-0x00000000067B4000-memory.dmp

Download

memory/1636-20-0x0000000006180000-0x00000000061E6000-memory.dmp

Download

memory/1636-14-0x00000000053B0000-0x00000000053E6000-memory.dmp

Download

memory/1636-19-0x00000000060A0000-0x0000000006106000-memory.dmp

Download

memory/1636-15-0x0000000074610000-0x0000000074DC0000-memory.dmp

Download

memory/1636-18-0x00000000059B0000-0x00000000059D2000-memory.dmp

Download

memory/1636-17-0x0000000005A70000-0x0000000006098000-memory.dmp

Download

memory/1636-16-0x0000000074610000-0x0000000074DC0000-memory.dmp

Download

memory/3224-69-0x000000006FC30000-0x000000006FC7C000-memory.dmp

Download

memory/4356-90-0x000000006FC30000-0x000000006FC7C000-memory.dmp

Download