xworm | 109e33011a54ee40a7c7cc676ce610d99f05b45cec517c629ec972b2c3fdc1ae

Analysis

max time kernel
147s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 15:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XClient.exe
Size 72KB
Sample240604-tc1psscf93
SHA256 109e33011a54ee40a7c7cc676ce610d99f05b45cec517c629ec972b2c3fdc1ae
MD5 74f9241e9dd88f8cc14f0e43acbd01f0
SHA1 a85dcca23169be055bf36b9bcf77926f3563f3e1
SHA512 cf7a465f887c73132141f1640301cf24f5105ddf225ba7e713c05f5142a6b8146aefd0aa2a2490f1b7b7d3be587fa8e178d147528fb24fd9ca26f25edfe2079e
SSDEEP 1536:FSqF2OmVmzhGNU/DF/LzfABcBsTCMobqRZ9k3v+6n+fdPOyKCqK/:5ctq/DdvfacB8CMobqfav+5OyKS/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

Version

ayumi-27013.portmap.host:27013

Attributes

install_file
USB.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1964-1-0x0000000000BF0000-0x0000000000C08000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2744	powershell.exe
2600	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2744	powershell.exe
2600	powershell.exe
1964	XClient.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1964	XClient.exe
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	1964	XClient.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1964	XClient.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2744	1964	XClient.exe	29
PID 1964 wrote to memory of 2744	1964	XClient.exe	29
PID 1964 wrote to memory of 2744	1964	XClient.exe	29
PID 1964 wrote to memory of 2600	1964	XClient.exe	31
PID 1964 wrote to memory of 2600	1964	XClient.exe	31
PID 1964 wrote to memory of 2600	1964	XClient.exe	31

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 35fab3f9691871d8c227e5a9360fb2a830c3973281cd6f57fc5392c875887b30
MD5 c70d8826d900d67a64c2b809e3a64bc3
SHA1 3fa792614843890cbc6d7c11ab618645d38c7142
SHA512 2ccab43b063ad4cb5aa7c87081bb9b4e22578629297056ef39fb9ddac514bcb1a057e9d07f51290fda3c4a1104ffdee55b54e15da57a13ff9b0a9c96a075d583
SSDEEP 96:jEh2ClM8+nqvsqvJCwocEh2ClM8+nqvsEHyqvJCwor1A/HQHNi7jNXlUVI:4rSUozrSAHnor1E4i7jNP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1964-0-0x000007FEF58F3000-0x000007FEF58F4000-memory.dmp

Download

memory/1964-1-0x0000000000BF0000-0x0000000000C08000-memory.dmp

Download

memory/1964-2-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp

Download

memory/1964-17-0x000007FEF58F3000-0x000007FEF58F4000-memory.dmp

Download

memory/1964-18-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp

Download

memory/2600-15-0x000000001B650000-0x000000001B932000-memory.dmp

Download

memory/2600-16-0x00000000027E0000-0x00000000027E8000-memory.dmp

Download

memory/2744-7-0x0000000002880000-0x0000000002900000-memory.dmp

Download

memory/2744-8-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Download

memory/2744-9-0x0000000001E90000-0x0000000001E98000-memory.dmp

Download