xworm | fb6d063dbb2fc0e750ac6143b255fd5e7146644009bfa22b80aba52a8c4cbc51

Analysis

max time kernel
137s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Inventory-List.js
Size 2.0MB
Sample240605-cs6sbacb97
SHA256 d5d2b8823c9d5d0671be0cf590e96cd08c26455805e406c3b71160967597561c
MD5 cf32d8818b9310662a43bb9b5165509d
SHA1 510217c9c260d423b66957adbe3c2af835ac10ad
SHA512 f5d5fd1c96310ba64a0afeddca726c2baab709eb76b4000fa9109b1decde92a8583cefe9ca4742e4cd3aee72c691a057f8a482f00ede4b654275159ae898c724
SSDEEP 384:0ODvx8wAkgmfWqSxvmdcwI2IfXherzYIbUsY4sEzfXtx65ziF/r2e+2NpbQ7RAe:Xvx8wApmJm8l/fdx65ziF/r7NQqe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

Mutex

etZTVSwBlveCYECe

Attributes

install_file
USB.exe
pastebin_url
https://pastebin.com/raw/Msa6vJjt

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4220-24-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 2 IoCs

pid	Process
1544	x.exe
4220	x.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\x = "C:\\Users\\Admin\\Documents\\x.pif"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
29	pastebin.com
30	pastebin.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1544 set thread context of 4220	1544	x.exe	103

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1544	x.exe
1544	x.exe
1544	x.exe
1544	x.exe
1544	x.exe
1544	x.exe
1544	x.exe
1544	x.exe
1544	x.exe
1544	x.exe
1544	x.exe
1544	x.exe
1544	x.exe
1544	x.exe
1544	x.exe
1544	x.exe
1544	x.exe
1544	x.exe
1544	x.exe
1544	x.exe
1544	x.exe
1544	x.exe
1544	x.exe
1544	x.exe
1544	x.exe
1544	x.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1544	x.exe
Token: SeDebugPrivilege	4220	x.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 1544	4476	wscript.exe	83
PID 4476 wrote to memory of 1544	4476	wscript.exe	83
PID 4476 wrote to memory of 1544	4476	wscript.exe	83
PID 1544 wrote to memory of 5100	1544	x.exe	98
PID 1544 wrote to memory of 5100	1544	x.exe	98
PID 1544 wrote to memory of 5100	1544	x.exe	98
PID 5100 wrote to memory of 3108	5100	cmd.exe	100
PID 5100 wrote to memory of 3108	5100	cmd.exe	100
PID 5100 wrote to memory of 3108	5100	cmd.exe	100
PID 1544 wrote to memory of 2200	1544	x.exe	101
PID 1544 wrote to memory of 2200	1544	x.exe	101
PID 1544 wrote to memory of 2200	1544	x.exe	101
PID 1544 wrote to memory of 4220	1544	x.exe	103
PID 1544 wrote to memory of 4220	1544	x.exe	103
PID 1544 wrote to memory of 4220	1544	x.exe	103
PID 1544 wrote to memory of 4220	1544	x.exe	103
PID 1544 wrote to memory of 4220	1544	x.exe	103
PID 1544 wrote to memory of 4220	1544	x.exe	103
PID 1544 wrote to memory of 4220	1544	x.exe	103
PID 1544 wrote to memory of 4220	1544	x.exe	103

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Inventory-List.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Users\Admin\AppData\Local\Temp\x.exe
  "C:\Users\Admin\AppData\Local\Temp\x.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "x" /t REG_SZ /F /D "C:\Users\Admin\Documents\x.pif"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5100
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "x" /t REG_SZ /F /D "C:\Users\Admin\Documents\x.pif"
      4⤵
      Adds Run key to start application
      PID:3108
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c Copy "C:\Users\Admin\AppData\Local\Temp\x.exe" "C:\Users\Admin\Documents\x.pif"
    3⤵
    PID:2200
- - C:\Users\Admin\AppData\Local\Temp\x.exe
    "C:\Users\Admin\AppData\Local\Temp\x.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

x.exe

Path C:\Users\Admin\AppData\Local\Temp\x.exe
Size 20KB
SHA256 cdf4b2b8f077d21ed624452271b193482334a403157a9b09944714dd6629b642
MD5 472ccfd514b47674fa9b16b138d5d4cc
SHA1 0959371cd257a10b519a88caad967640fae582b0
SHA512 d992e1adf1f021d17a957e75c144fa2f8ddcaa5eeb8da519441f23b4cbc07ce38e0fe3e8311e5af518c74d1542f37c50ed6c9b41f414d5f73c56c2d83918ca81
SSDEEP 384:+u5YJTwwDydwwDydfFdr44bYg0f/Ks+BNTTylw7dorxLAcVpKLXjj56I:+u5YJ9d/0gm/8B4lrRAcCjjg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1544-16-0x0000000004BB0000-0x0000000004BBA000-memory.dmp

Download

memory/1544-18-0x0000000006A50000-0x0000000006A6E000-memory.dmp

Download

memory/1544-13-0x0000000004EC0000-0x0000000005464000-memory.dmp

Download

memory/1544-14-0x0000000004A00000-0x0000000004A92000-memory.dmp

Download

memory/1544-15-0x0000000074920000-0x00000000750D0000-memory.dmp

Download

memory/1544-11-0x000000007492E000-0x000000007492F000-memory.dmp

Download

memory/1544-17-0x0000000004C60000-0x0000000004CD6000-memory.dmp

Download

memory/1544-12-0x0000000000010000-0x000000000001A000-memory.dmp

Download

memory/1544-19-0x0000000006AD0000-0x0000000006B2A000-memory.dmp

Download

memory/1544-20-0x0000000006CE0000-0x0000000006D7C000-memory.dmp

Download

memory/1544-21-0x0000000006D80000-0x0000000006DE6000-memory.dmp

Download

memory/1544-28-0x0000000074920000-0x00000000750D0000-memory.dmp

Download

memory/1544-26-0x000000007492E000-0x000000007492F000-memory.dmp

Download

memory/4220-24-0x0000000000400000-0x000000000040E000-memory.dmp

Download