xworm | 209e122072c202f0e7663407dbfb6c99774360ee736fcaad8a6998adbb06224e

Reason

Machine shutdown

General

Target
KVRT.exe
Size 95KB
Sample240531-dps8gsec37
SHA256 209e122072c202f0e7663407dbfb6c99774360ee736fcaad8a6998adbb06224e
MD5 caacc00a3a1be01e99f29abcf5f242c4
SHA1 2605c5337c15fda32deafe27d49baf34ab892561
SHA512 3ca0c64f573bb07b2b93ec2bbffe9684bbc6e764f0ab07d716d1d035897aaf0c6d71444e569deb28ef57067717b30f52b20eba5176c657fe0c69746778d852e1
SSDEEP 1536:ayKsbRFiE6iZdEOOQ/hAyBxbBTNk34Y6yRNZpqHOy+guV5V:dPRp6bPQG4xbB44gZgHOy+F5V
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:40971
us3.localto.net:40971
Name1442-40971.portmap.host:40971

Attributes

Install_directory
%Temp%
install_file
KVRT.exe
telegram
https://api.telegram.org/bot6916721041:AAGsGXyaplDWQ9HJlE88Z36KtBFClSB3E20

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2040-1-0x0000000000D30000-0x0000000000D4E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2276	powershell.exe
2604	powershell.exe
2448	powershell.exe
2904	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KVRT.lnk	KVRT.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KVRT.lnk	KVRT.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\KVRT = "C:\\Users\\Admin\\AppData\\Local\\Temp\\KVRT.exe"	KVRT.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2748	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2040	KVRT.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2276	powershell.exe
2604	powershell.exe
2448	powershell.exe
2904	powershell.exe
2040	KVRT.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2040	KVRT.exe
Token: SeDebugPrivilege	2276	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	2448	powershell.exe
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	2040	KVRT.exe
Token: SeDebugPrivilege	1236	KVRT.exe
Token: SeShutdownPrivilege	1708	shutdown.exe
Token: SeRemoteShutdownPrivilege	1708	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2040	KVRT.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2276	2040	KVRT.exe	29
PID 2040 wrote to memory of 2276	2040	KVRT.exe	29
PID 2040 wrote to memory of 2276	2040	KVRT.exe	29
PID 2040 wrote to memory of 2604	2040	KVRT.exe	31
PID 2040 wrote to memory of 2604	2040	KVRT.exe	31
PID 2040 wrote to memory of 2604	2040	KVRT.exe	31
PID 2040 wrote to memory of 2448	2040	KVRT.exe	33
PID 2040 wrote to memory of 2448	2040	KVRT.exe	33
PID 2040 wrote to memory of 2448	2040	KVRT.exe	33
PID 2040 wrote to memory of 2904	2040	KVRT.exe	35
PID 2040 wrote to memory of 2904	2040	KVRT.exe	35
PID 2040 wrote to memory of 2904	2040	KVRT.exe	35
PID 2040 wrote to memory of 2748	2040	KVRT.exe	37
PID 2040 wrote to memory of 2748	2040	KVRT.exe	37
PID 2040 wrote to memory of 2748	2040	KVRT.exe	37
PID 2216 wrote to memory of 1236	2216	taskeng.exe	40
PID 2216 wrote to memory of 1236	2216	taskeng.exe	40
PID 2216 wrote to memory of 1236	2216	taskeng.exe	40
PID 2040 wrote to memory of 1708	2040	KVRT.exe	41
PID 2040 wrote to memory of 1708	2040	KVRT.exe	41
PID 2040 wrote to memory of 1708	2040	KVRT.exe	41

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\KVRT.exe
"C:\Users\Admin\AppData\Local\Temp\KVRT.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\KVRT.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'KVRT.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\KVRT.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'KVRT.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2904
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "KVRT" /tr "C:\Users\Admin\AppData\Local\Temp\KVRT.exe"
  2⤵
  - Creates scheduled task(s)
  PID:2748
- C:\Windows\system32\shutdown.exe
  shutdown.exe /f /s /t 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1708

C:\Windows\system32\taskeng.exe
taskeng.exe {D86AC03E-CA92-4624-9891-41C0CD1FFE2F} S-1-5-21-2248906074-2862704502-246302768-1000:GHPZRGFC\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Users\Admin\AppData\Local\Temp\KVRT.exe
  C:\Users\Admin\AppData\Local\Temp\KVRT.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1236

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2236

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 6520a7f4d23b56f9c832cb9f77ba79e3846d42e0cc578211c9d48be2dda6b7a3
MD5 e41fa111432d4614bb0891e1c5cfe79c
SHA1 c86f49e0bb88d195161fd0948b75dc57383dd430
SHA512 c4bb6ef2677f2071deb31b2645abce18b2afc517c7ec4ce264b57d4d90e5fbe1f75750fc90b15dc089588245c0c95969193b535a3cc94b511675e44e0ddbf7a7
SSDEEP 96:0qAFwCaIM8FnqvsqvJCwowqAFwCaIM8FnqvsEHyqvJCwor8U3sQHqo7TWXlUVb:rAFhpUoHAFhpAHnor87ro7TWg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2040-0-0x000007FEF5283000-0x000007FEF5284000-memory.dmp

Download

memory/2040-1-0x0000000000D30000-0x0000000000D4E000-memory.dmp

Download

memory/2040-2-0x000007FEF5280000-0x000007FEF5C6C000-memory.dmp

Download

memory/2040-28-0x000007FEF5283000-0x000007FEF5284000-memory.dmp

Download

memory/2040-29-0x000007FEF5280000-0x000007FEF5C6C000-memory.dmp

Download

memory/2040-30-0x000007FEF5280000-0x000007FEF5C6C000-memory.dmp

Download

memory/2276-7-0x0000000002E40000-0x0000000002EC0000-memory.dmp

Download

memory/2276-8-0x000000001B800000-0x000000001BAE2000-memory.dmp

Download

memory/2276-9-0x0000000000470000-0x0000000000478000-memory.dmp

Download

memory/2604-15-0x000000001B580000-0x000000001B862000-memory.dmp

Download

memory/2604-16-0x0000000001C10000-0x0000000001C18000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads