xworm | 8c6c3a3ce887c50115f2c0c67ab7520171fead564c2510c9583f89df40e5b21f

Analysis

max time kernel
299s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
asd.exe
Size 39KB
Sample240602-pcs8hada73
SHA256 8c6c3a3ce887c50115f2c0c67ab7520171fead564c2510c9583f89df40e5b21f
MD5 d77e723db745636403026a027db6465d
SHA1 fc98c6a954c7491a4c67d10d7c0d5185a5f19089
SHA512 3d809e2a21dbd88eba9b54494a776a6296b2dca0e5ccfb7d4097b56cf6946e485a0ceef0376332d118d0a10660eebbd3036e0a93803d4e40c13cade760168b00
SSDEEP 768:YvD0gwVah58db34S4oWWiFhUiCKuuPKcJfFWPa9f36POwhE8aCh:WD0g0G5g3xJj3iCKuufFv9f36POwnTh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

Version

192.168.0.103:7125

Mutex

78QGr0NDEgQMCoit

Attributes

Install_directory
%AppData%
install_file
pysploit.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/memory/2092-0-0x00000000008F0000-0x0000000000900000-memory.dmp	family_xworm
behavioral2/files/0x000e0000000232f8-60.dat	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4788	powershell.exe
4888	powershell.exe
3568	powershell.exe
3848	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	asd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pysploit.lnk	asd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pysploit.lnk	asd.exe

Executes dropped EXE 5 IoCs

pid	Process
2280	pysploit.exe
4072	pysploit.exe
1888	pysploit.exe
984	pysploit.exe
1568	pysploit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3712	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4788	powershell.exe
4788	powershell.exe
4788	powershell.exe
4888	powershell.exe
4888	powershell.exe
4888	powershell.exe
3568	powershell.exe
3568	powershell.exe
3568	powershell.exe
3848	powershell.exe
3848	powershell.exe
3848	powershell.exe
2092	asd.exe
2092	asd.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	2092	asd.exe
Token: SeDebugPrivilege	4788	powershell.exe
Token: SeDebugPrivilege	4888	powershell.exe
Token: SeDebugPrivilege	3568	powershell.exe
Token: SeDebugPrivilege	3848	powershell.exe
Token: SeDebugPrivilege	2092	asd.exe
Token: SeDebugPrivilege	2280	pysploit.exe
Token: SeDebugPrivilege	4072	pysploit.exe
Token: SeDebugPrivilege	1888	pysploit.exe
Token: SeDebugPrivilege	984	pysploit.exe
Token: SeDebugPrivilege	1568	pysploit.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2092	asd.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 4788	2092	asd.exe	96
PID 2092 wrote to memory of 4788	2092	asd.exe	96
PID 2092 wrote to memory of 4888	2092	asd.exe	99
PID 2092 wrote to memory of 4888	2092	asd.exe	99
PID 2092 wrote to memory of 3568	2092	asd.exe	102
PID 2092 wrote to memory of 3568	2092	asd.exe	102
PID 2092 wrote to memory of 3848	2092	asd.exe	105
PID 2092 wrote to memory of 3848	2092	asd.exe	105
PID 2092 wrote to memory of 3712	2092	asd.exe	107
PID 2092 wrote to memory of 3712	2092	asd.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\asd.exe
"C:\Users\Admin\AppData\Local\Temp\asd.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\asd.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'asd.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\pysploit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'pysploit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3848
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "pysploit" /tr "C:\Users\Admin\AppData\Roaming\pysploit.exe"
  2⤵
  - Creates scheduled task(s)
  PID:3712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4296,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
1⤵
PID:4844

C:\Users\Admin\AppData\Roaming\pysploit.exe
C:\Users\Admin\AppData\Roaming\pysploit.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2280

C:\Users\Admin\AppData\Roaming\pysploit.exe
C:\Users\Admin\AppData\Roaming\pysploit.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4072

C:\Users\Admin\AppData\Roaming\pysploit.exe
C:\Users\Admin\AppData\Roaming\pysploit.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1888

C:\Users\Admin\AppData\Roaming\pysploit.exe
C:\Users\Admin\AppData\Roaming\pysploit.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:984

C:\Users\Admin\AppData\Roaming\pysploit.exe
C:\Users\Admin\AppData\Roaming\pysploit.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b8be6896ca89d3ebe9ee8a94e3407483f4750badaf7fa33526817cfc926dc291
MD5 71fa55c67a762ba70e40011153e19b3c
SHA1 a36d2bb4802a8ec7db1a68de5f0c3d6007987492
SHA512 32760af7c05e20fec8cbddf56c2df544a69335f930f1d313cd1fdceaa90ed2afe81e54ac1b6770097d6f5ca5f30955f95970171a453579aa19239a17aaefe47f
MD5 SHA1 SHA512

Submit Download

pysploit.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\pysploit.exe.log
Size 654B
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 df0a3f5bc0f10a3805b11a694436d90531a5c18d9a2b5b9a1b6e9f754127ba02
MD5 d7bc0f2aa4e604cf644dfbb5a44a423a
SHA1 1c2b17c548e8e4cdeca4a559bfe6d19f8f177256
SHA512 2889fbce24ffac501e94275dfc6ba3d47c2f9e3b91a6ec22311e540292084a8fc15670e83b7b95ac6e935d40e7fed667c40e6f2241ed378e46fd813b274b35a5
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98
MD5 eb1ad317bd25b55b2bbdce8a28a74a94
SHA1 98a3978be4d10d62e7411946474579ee5bdc5ea6
SHA512 d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 895eb57409991d9c805c91cc89dbfae5828e8355fe02628c390b2fbe1a75cf6c
MD5 1dd8648df1581687db3c443025ee7399
SHA1 f28080fdbaf8533003d8a512ce7bf639759cfd08
SHA512 15bf22009876753580dc12fbbf5f8a8cd5c4d99fecad016f67b817b9d4b10f4fd2c2473483dd94490c26b8c4962397d1c134bfc00a7a88a7b246cd2f4d66c9e0
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_ucuvzvfx.t4n.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ucuvzvfx.t4n.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

pysploit.exe

Path C:\Users\Admin\AppData\Roaming\pysploit.exe
Size 39KB
SHA256 8c6c3a3ce887c50115f2c0c67ab7520171fead564c2510c9583f89df40e5b21f
MD5 d77e723db745636403026a027db6465d
SHA1 fc98c6a954c7491a4c67d10d7c0d5185a5f19089
SHA512 3d809e2a21dbd88eba9b54494a776a6296b2dca0e5ccfb7d4097b56cf6946e485a0ceef0376332d118d0a10660eebbd3036e0a93803d4e40c13cade760168b00
SSDEEP 768:YvD0gwVah58db34S4oWWiFhUiCKuuPKcJfFWPa9f36POwhE8aCh:WD0g0G5g3xJj3iCKuufFv9f36POwnTh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2092-56-0x00007FF842BE0000-0x00007FF8436A1000-memory.dmp

Download

memory/2092-0-0x00000000008F0000-0x0000000000900000-memory.dmp

Download

memory/2092-57-0x00007FF842BE3000-0x00007FF842BE5000-memory.dmp

Download

memory/2092-58-0x00007FF842BE0000-0x00007FF8436A1000-memory.dmp

Download

memory/2092-1-0x00007FF842BE3000-0x00007FF842BE5000-memory.dmp

Download

memory/4788-17-0x00007FF842BE0000-0x00007FF8436A1000-memory.dmp

Download

memory/4788-14-0x00007FF842BE0000-0x00007FF8436A1000-memory.dmp

Download

memory/4788-13-0x00007FF842BE0000-0x00007FF8436A1000-memory.dmp

Download

memory/4788-12-0x00007FF842BE0000-0x00007FF8436A1000-memory.dmp

Download

memory/4788-11-0x00000264CC170000-0x00000264CC192000-memory.dmp

Download