xworm | f302df05db0c085c2614de01d1f351d88b102863bebdfa6fd2cb6dbba266889c

General

Target

MainUpdated.exe
Size

61KB
MD5

2d1117e76971378d13a5d79451fa585c
SHA1

4cb446c2a6312b6da19683638f9ef16ae71e6328
SHA256

f302df05db0c085c2614de01d1f351d88b102863bebdfa6fd2cb6dbba266889c
SHA512

6545b824ea6b5659cba7cc5761bb0e68db3071c0077a39dc6257142defd49b370b11779243700f8acd4c25acac8fd39569f2c7a1b7e721ca90db74303dbb8ce5
SSDEEP

1536:9jXPnvGv/tWNV9VsdCKoCRkbTCbBvP/OjQqudk+:9jX/qWz9OdDkbTGn/OjQqj+

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

C2

https://pastebin.com/raw/H3wFXmEi:1234

Attributes

install_file
USB.exe
pastebin_url
https://pastebin.com/raw/H3wFXmEi

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1800-1-0x0000000000750000-0x0000000000766000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	pastebin.com
7	pastebin.com

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	1800	MainUpdated.exe
Token: SeDebugPrivilege	540	MainUpdated.exe
Token: SeDebugPrivilege	4368	MainUpdated.exe
Token: SeDebugPrivilege	4340	MainUpdated.exe
Token: SeDebugPrivilege	4580	MainUpdated.exe
Token: SeDebugPrivilege	3656	MainUpdated.exe
Token: SeDebugPrivilege	1568	MainUpdated.exe
Token: SeDebugPrivilege	1432	MainUpdated.exe
Token: SeDebugPrivilege	4992	MainUpdated.exe
Token: SeDebugPrivilege	1536	MainUpdated.exe
Token: SeDebugPrivilege	1072	MainUpdated.exe
Token: SeDebugPrivilege	1924	MainUpdated.exe

C:\Users\Admin\AppData\Local\Temp\MainUpdated.exe
"C:\Users\Admin\AppData\Local\Temp\MainUpdated.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:2652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3860 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:2936

C:\Users\Admin\AppData\Local\Temp\MainUpdated.exe
"C:\Users\Admin\AppData\Local\Temp\MainUpdated.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:540

C:\Users\Admin\AppData\Local\Temp\MainUpdated.exe
"C:\Users\Admin\AppData\Local\Temp\MainUpdated.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4368

C:\Users\Admin\AppData\Local\Temp\MainUpdated.exe
"C:\Users\Admin\AppData\Local\Temp\MainUpdated.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4340

C:\Users\Admin\AppData\Local\Temp\MainUpdated.exe
"C:\Users\Admin\AppData\Local\Temp\MainUpdated.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4580

C:\Users\Admin\AppData\Local\Temp\MainUpdated.exe
"C:\Users\Admin\AppData\Local\Temp\MainUpdated.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3656

C:\Users\Admin\AppData\Local\Temp\MainUpdated.exe
"C:\Users\Admin\AppData\Local\Temp\MainUpdated.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1568

C:\Users\Admin\AppData\Local\Temp\MainUpdated.exe
"C:\Users\Admin\AppData\Local\Temp\MainUpdated.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1432

C:\Users\Admin\AppData\Local\Temp\MainUpdated.exe
"C:\Users\Admin\AppData\Local\Temp\MainUpdated.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4992

C:\Users\Admin\AppData\Local\Temp\MainUpdated.exe
"C:\Users\Admin\AppData\Local\Temp\MainUpdated.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1536

C:\Users\Admin\AppData\Local\Temp\MainUpdated.exe
"C:\Users\Admin\AppData\Local\Temp\MainUpdated.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1072

C:\Users\Admin\AppData\Local\Temp\MainUpdated.exe
"C:\Users\Admin\AppData\Local\Temp\MainUpdated.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MainUpdated.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
memory/540-5-0x00007FF9EA910000-0x00007FF9EB3D1000-memory.dmp

Filesize
10.8MB

Download
memory/540-7-0x00007FF9EA910000-0x00007FF9EB3D1000-memory.dmp

Filesize
10.8MB

Download
memory/1800-0-0x00007FF9EA913000-0x00007FF9EA915000-memory.dmp

Filesize
8KB

Download
memory/1800-1-0x0000000000750000-0x0000000000766000-memory.dmp

Filesize
88KB

Download
memory/1800-2-0x00007FF9EA910000-0x00007FF9EB3D1000-memory.dmp

Filesize
10.8MB

Download
memory/1800-3-0x00007FF9EA913000-0x00007FF9EA915000-memory.dmp

Filesize
8KB

Download
memory/1800-4-0x00007FF9EA910000-0x00007FF9EB3D1000-memory.dmp

Filesize
10.8MB

Download
memory/4368-9-0x00007FF9EA910000-0x00007FF9EB3D1000-memory.dmp

Filesize
10.8MB

Download
memory/4368-10-0x00007FF9EA910000-0x00007FF9EB3D1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing