xworm | 86c8da270e82ac4d2e27ac6ec56d7dd1df44d2bcb9ce22e008d9647fdba87243

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2eb0ac82f49347944e4ef29cb53eca48.exe
Size 28KB
Sample240601-e24enahh6t
SHA256 86c8da270e82ac4d2e27ac6ec56d7dd1df44d2bcb9ce22e008d9647fdba87243
MD5 2eb0ac82f49347944e4ef29cb53eca48
SHA1 c28c8c943d7ccc805cbc5cdc5f697d1ee3815b0f
SHA512 6e9f916a6239b27ef4120ffd235409c9476cc49fdecbfff31fc5c15cb5769b39107ea4e1d93c61f60ec3df22ea5d09723a42d6287e7b52f77843357f04a8e327
SSDEEP 384:eECXT3ICEAFK9pVMFlvF2Gn6sBMIzYVT4l2EZ:2T4CUuFlvFJ6jMUTA2E
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

41.216.183.101:7000

Mutex

c7YV1Yp3sakxXjWx

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2992-2-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4544 set thread context of 2992	4544	2eb0ac82f49347944e4ef29cb53eca48.exe	91

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2992	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4544	2eb0ac82f49347944e4ef29cb53eca48.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 2992	4544	2eb0ac82f49347944e4ef29cb53eca48.exe	91
PID 4544 wrote to memory of 2992	4544	2eb0ac82f49347944e4ef29cb53eca48.exe	91
PID 4544 wrote to memory of 2992	4544	2eb0ac82f49347944e4ef29cb53eca48.exe	91
PID 4544 wrote to memory of 2992	4544	2eb0ac82f49347944e4ef29cb53eca48.exe	91
PID 4544 wrote to memory of 2992	4544	2eb0ac82f49347944e4ef29cb53eca48.exe	91
PID 4544 wrote to memory of 2992	4544	2eb0ac82f49347944e4ef29cb53eca48.exe	91
PID 4544 wrote to memory of 2992	4544	2eb0ac82f49347944e4ef29cb53eca48.exe	91
PID 4544 wrote to memory of 2992	4544	2eb0ac82f49347944e4ef29cb53eca48.exe	91

C:\Users\Admin\AppData\Local\Temp\2eb0ac82f49347944e4ef29cb53eca48.exe
"C:\Users\Admin\AppData\Local\Temp\2eb0ac82f49347944e4ef29cb53eca48.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3820 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:3304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2992-2-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/2992-3-0x0000000074A2E000-0x0000000074A2F000-memory.dmp

Download

memory/2992-4-0x0000000005900000-0x000000000599C000-memory.dmp

Download

memory/2992-5-0x0000000074A20000-0x00000000751D0000-memory.dmp

Download

memory/2992-6-0x0000000074A2E000-0x0000000074A2F000-memory.dmp

Download

memory/2992-7-0x0000000074A20000-0x00000000751D0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads