xworm | a443445abb02a4352781109b5fdd416ddc3551a71019d076ba2c99dd308ea021

Analysis

max time kernel
147s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe
Size 509KB
Sample240601-efrtqshf36
SHA256 cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651
MD5 ff3aea929347d0168b02de5d2c2bcec3
SHA1 fd7eaa628f424fc1384bcbd926a551c8e60740db
SHA512 c5ba038472b25fa013852b57fa712a286e56a85f015b68c5e7da72ed403aa0b896deb6583407894ae76dc59e90c475a161504d55202b4b7fe774732b22793c3b
SSDEEP 12288:lUrKkGdrJwKcItNXOMaFshRSxD1ulXrvNE53jHd:DcA9NEQlXTaT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

104.250.180.178:7061

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/780-10-0x0000000000400000-0x0000000000414000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3248	powershell.exe
2492	powershell.exe
4540	powershell.exe
3684	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1992 set thread context of 780	1992	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	95

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3248	powershell.exe
3248	powershell.exe
2492	powershell.exe
2492	powershell.exe
4540	powershell.exe
4540	powershell.exe
3684	powershell.exe
3684	powershell.exe
780	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	780	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe
Token: SeDebugPrivilege	3248	powershell.exe
Token: SeDebugPrivilege	2492	powershell.exe
Token: SeDebugPrivilege	4540	powershell.exe
Token: SeDebugPrivilege	3684	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
780	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 780	1992	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	95
PID 1992 wrote to memory of 780	1992	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	95
PID 1992 wrote to memory of 780	1992	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	95
PID 1992 wrote to memory of 780	1992	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	95
PID 1992 wrote to memory of 780	1992	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	95
PID 1992 wrote to memory of 780	1992	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	95
PID 1992 wrote to memory of 780	1992	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	95
PID 1992 wrote to memory of 780	1992	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	95
PID 780 wrote to memory of 3248	780	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	96
PID 780 wrote to memory of 3248	780	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	96
PID 780 wrote to memory of 3248	780	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	96
PID 780 wrote to memory of 2492	780	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	98
PID 780 wrote to memory of 2492	780	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	98
PID 780 wrote to memory of 2492	780	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	98
PID 780 wrote to memory of 4540	780	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	100
PID 780 wrote to memory of 4540	780	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	100
PID 780 wrote to memory of 4540	780	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	100
PID 780 wrote to memory of 3684	780	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	102
PID 780 wrote to memory of 3684	780	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	102
PID 780 wrote to memory of 3684	780	cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe	102

C:\Users\Admin\AppData\Local\Temp\cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe
"C:\Users\Admin\AppData\Local\Temp\cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Users\Admin\AppData\Local\Temp\cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe
  "C:\Users\Admin\AppData\Local\Temp\cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3248
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2492
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4540
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe.log
Size 1KB
SHA256 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
MD5 8ec831f3e3a3f77e4a7b9cd32b48384c
SHA1 d83f09fd87c5bd86e045873c231c14836e76a05c
SHA512 26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 2c65e4472f8bdec9107dfe8ca3bb613c0b059224a735ee48350f801c00f3f2b7
MD5 cbcc34168adf9e736d8cfa24df969716
SHA1 efb96a8a1d371d0561bf08250c59c97350a30383
SHA512 fdc35e89300c9c9b625a83333ff7241d26b7b302f986b18bb4e7647a8af067c072feacb952909d96106599564d363bf8362c6f5470c042a052ed289620dc272e
SSDEEP 384:Oi+B+91H33Nw64QYe5xo9o5AGNY19bG3oZ+xunuTllq+nUmVhi0SO1:rjH327u5io5AGNAWxx8ubUmri0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 528ede03f0e336f931766acc2731d1cb82b180551bb76625d50c245af1ba7500
MD5 a3b577849fb6975d7ea4b95f45820819
SHA1 c7f039c2019da2db0ba247fa87688fb9f4fcaa6f
SHA512 27f847c9577069978de872d1a130bafa1fcd421adb77822540f49ed25cac25a6a854f3d9315b41216e1f99f550bf1736c505f693858f77b72a61861586df068d
SSDEEP 384:6sf+Bz9i+1KBBiz7mLcRo9oFwKGTELK6seYwME/x03SoZVfYSgQjEDkiQ0gdotk6:HfGOo/aloyKGTELNfraSoWuEDPCK3
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 d24b56c5d5abf7aea105b2a8719760e65dc7229ea4095e60f85ece4b550b9807
MD5 d3185088fa2729c4c6857b20937961d1
SHA1 361e07c0ab4f13816252c994e41ac042122e01a1
SHA512 1f047ad616f4570e65dd850e957187c52f2c8ed9d53110f43066c0b4d14bed4e2d454f230afe44fa76aff96b9e3d834181c4f13580f5259f96381018a76eb16c
SSDEEP 384:tisf+B/991roYfZaIHwZNXkyto9+uNcqIu0ioZ+GJ7L+nRVkki0SO1:t/fucYB98N0j+uNfI6xGJ2Riki0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_jdluj3nn.l0r.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jdluj3nn.l0r.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/780-129-0x0000000074670000-0x0000000074E20000-memory.dmp

Download

memory/780-14-0x0000000074670000-0x0000000074E20000-memory.dmp

Download

memory/780-128-0x0000000074670000-0x0000000074E20000-memory.dmp

Download

memory/780-130-0x0000000074670000-0x0000000074E20000-memory.dmp

Download

memory/780-10-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1992-5-0x0000000074670000-0x0000000074E20000-memory.dmp

Download

memory/1992-13-0x0000000074670000-0x0000000074E20000-memory.dmp

Download

memory/1992-6-0x0000000004F30000-0x0000000004FCC000-memory.dmp

Download

memory/1992-9-0x0000000006140000-0x0000000006196000-memory.dmp

Download

memory/1992-7-0x0000000005F10000-0x0000000005F28000-memory.dmp

Download

memory/1992-8-0x0000000005250000-0x0000000005260000-memory.dmp

Download

memory/1992-4-0x0000000004E80000-0x0000000004E8A000-memory.dmp

Download

memory/1992-3-0x0000000004CB0000-0x0000000004D42000-memory.dmp

Download

memory/1992-2-0x0000000005260000-0x0000000005804000-memory.dmp

Download

memory/1992-1-0x0000000000250000-0x00000000002D4000-memory.dmp

Download

memory/1992-0-0x000000007467E000-0x000000007467F000-memory.dmp

Download

memory/2492-71-0x000000006FC90000-0x000000006FCDC000-memory.dmp

Download

memory/3248-33-0x00000000061A0000-0x00000000061BE000-memory.dmp

Download

memory/3248-54-0x0000000007700000-0x0000000007714000-memory.dmp

Download

memory/3248-34-0x0000000006240000-0x000000000628C000-memory.dmp

Download

memory/3248-35-0x0000000006770000-0x00000000067A2000-memory.dmp

Download

memory/3248-36-0x000000006FC90000-0x000000006FCDC000-memory.dmp

Download

memory/3248-46-0x0000000006750000-0x000000000676E000-memory.dmp

Download

memory/3248-47-0x0000000007370000-0x0000000007413000-memory.dmp

Download

memory/3248-48-0x0000000007B10000-0x000000000818A000-memory.dmp

Download

memory/3248-49-0x00000000074C0000-0x00000000074DA000-memory.dmp

Download

memory/3248-50-0x0000000007520000-0x000000000752A000-memory.dmp

Download

memory/3248-51-0x0000000007750000-0x00000000077E6000-memory.dmp

Download

memory/3248-52-0x00000000076C0000-0x00000000076D1000-memory.dmp

Download

memory/3248-53-0x00000000076F0000-0x00000000076FE000-memory.dmp

Download

memory/3248-23-0x0000000005BD0000-0x0000000005F24000-memory.dmp

Download

memory/3248-55-0x0000000007810000-0x000000000782A000-memory.dmp

Download

memory/3248-56-0x0000000007740000-0x0000000007748000-memory.dmp

Download

memory/3248-59-0x0000000074670000-0x0000000074E20000-memory.dmp

Download

memory/3248-19-0x00000000051F0000-0x0000000005212000-memory.dmp

Download

memory/3248-20-0x0000000074670000-0x0000000074E20000-memory.dmp

Download

memory/3248-22-0x0000000005B60000-0x0000000005BC6000-memory.dmp

Download

memory/3248-21-0x0000000005310000-0x0000000005376000-memory.dmp

Download

memory/3248-16-0x0000000074670000-0x0000000074E20000-memory.dmp

Download

memory/3248-17-0x0000000005430000-0x0000000005A58000-memory.dmp

Download

memory/3248-15-0x0000000004C10000-0x0000000004C46000-memory.dmp

Download

memory/3248-18-0x0000000074670000-0x0000000074E20000-memory.dmp

Download

memory/3684-113-0x000000006FC90000-0x000000006FCDC000-memory.dmp

Download

memory/4540-92-0x000000006FC90000-0x000000006FCDC000-memory.dmp

Download