xworm | ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 02:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe
Size 541KB
Sample240607-c7mb8agd2t
SHA256 ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb
MD5 07dde049463fbfb5f7fd98ae179dce42
SHA1 825b4107184b769deed76a3237dd4d3d4425f1b9
SHA512 c3240d7ce73e244641340e547d2bed4a9068557fff0bbe5e25520ed286cc0ba8e42d4be05a526e612ac19d73e2579a7dcfec18c8d47c244d666956c7d4ce34dc
SSDEEP 12288:5gsrmSiqyJMVD77D4/Kj0IjLv/rlZiVQNQqLWukPgSc:lp5O4Qyj0Ijr/vWELaPgS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

104.250.180.178:7061

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1884-11-0x0000000000400000-0x0000000000414000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral2/memory/1884-11-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1168	powershell.exe
4596	powershell.exe
5016	powershell.exe
1716	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3444 set thread context of 1884	3444	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe	105

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3444	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe
3444	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe
1168	powershell.exe
1168	powershell.exe
1168	powershell.exe
4596	powershell.exe
4596	powershell.exe
4596	powershell.exe
5016	powershell.exe
5016	powershell.exe
5016	powershell.exe
1716	powershell.exe
1716	powershell.exe
1716	powershell.exe
1884	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe
1884	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3444	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe
Token: SeDebugPrivilege	1884	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe
Token: SeDebugPrivilege	1168	powershell.exe
Token: SeDebugPrivilege	4596	powershell.exe
Token: SeDebugPrivilege	5016	powershell.exe
Token: SeDebugPrivilege	1716	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1884	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 5016	3444	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe	104
PID 3444 wrote to memory of 5016	3444	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe	104
PID 3444 wrote to memory of 5016	3444	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe	104
PID 3444 wrote to memory of 1884	3444	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe	105
PID 3444 wrote to memory of 1884	3444	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe	105
PID 3444 wrote to memory of 1884	3444	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe	105
PID 3444 wrote to memory of 1884	3444	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe	105
PID 3444 wrote to memory of 1884	3444	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe	105
PID 3444 wrote to memory of 1884	3444	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe	105
PID 3444 wrote to memory of 1884	3444	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe	105
PID 3444 wrote to memory of 1884	3444	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe	105
PID 1884 wrote to memory of 1168	1884	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe	106
PID 1884 wrote to memory of 1168	1884	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe	106
PID 1884 wrote to memory of 1168	1884	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe	106
PID 1884 wrote to memory of 4596	1884	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe	108
PID 1884 wrote to memory of 4596	1884	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe	108
PID 1884 wrote to memory of 4596	1884	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe	108
PID 1884 wrote to memory of 5016	1884	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe	110
PID 1884 wrote to memory of 5016	1884	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe	110
PID 1884 wrote to memory of 5016	1884	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe	110
PID 1884 wrote to memory of 1716	1884	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe	112
PID 1884 wrote to memory of 1716	1884	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe	112
PID 1884 wrote to memory of 1716	1884	ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe	112

C:\Users\Admin\AppData\Local\Temp\ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe
"C:\Users\Admin\AppData\Local\Temp\ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Users\Admin\AppData\Local\Temp\ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe
  "C:\Users\Admin\AppData\Local\Temp\ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe"
  2⤵
  PID:5016
- C:\Users\Admin\AppData\Local\Temp\ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe
  "C:\Users\Admin\AppData\Local\Temp\ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1168
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4596
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5016
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4404,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:8
1⤵
PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb.exe.log
Size 1KB
SHA256 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
MD5 8ec831f3e3a3f77e4a7b9cd32b48384c
SHA1 d83f09fd87c5bd86e045873c231c14836e76a05c
SHA512 26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 c488166ef9738dfd874ccc6c9cc444203dc0db6712224ce74fe49964bcbfafea
MD5 8f14fec5a7fd81decbaf3d5d7fa03f07
SHA1 710691f44705565a985dbb0981edc491f784a20b
SHA512 b61e267e571a179fde2f389058a841438e84bb15b87984db0ac8e90fe77bfd2b6aa7c723daa1f9455e78dd896c14178f811af39c658b8a58258831bc9796d2aa
SSDEEP 384:v6+BY991svgyL4YBBiz8k+o9ovARNY1qZ0ioZ+j2Urq+nUmVhi0SO1:C/s4ooLjovARNfRxj2UbUmri0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 6e99fa25682135a888e1a733649c6e32d97591e31f7b8c30d97836c333f6b628
MD5 03cae4afc88a90cf31cfdd020d553c37
SHA1 e8010de19ebd1f23f2d47bd57ffe227b9e17da56
SHA512 777a3fca53358e02b21212b181fc2e63484b4c0b495e5b21d94fe21df542e9f60f768f1d11634259690659927276de97288d2863df7f227edf9fca7f6f286d19
SSDEEP 384:Bsf+BY9i+PADizprFROvk+o9o2QOK6seYwME/l03SoZdfYSgcjEDkyQ0gdEtkKhD:mfFA8px8sjo2QONfrOSwWCED/Ce3
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 a0ba20b1101225f0ace7e35dddd400d1ac9ab09976083233f6898acd8c49f649
MD5 56f57755c330429c45f9840c186bdd5d
SHA1 a85f7ee2b96e8001caeb2a752cfd5b698b13c317
SHA512 55b43ff183b292168fa90b4c8d56b6ba039808aa122493198e4809d15078efba014cf361897b43294bc20a448db107c1cb6f58fcbe939a8cf41fce934898a22c
SSDEEP 384:Wsf+Bl91HI26f+bFRpRNho9+hT9NY19LGZcifEz+h5inL+nUUhi0SO1:zfuHfTNS+hT9NAVifxh5iKUki0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_bsqufgu0.xg2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bsqufgu0.xg2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/1168-56-0x0000000007AD0000-0x0000000007AD8000-memory.dmp

Download

memory/1168-47-0x0000000007710000-0x00000000077B3000-memory.dmp

Download

memory/1168-59-0x0000000074B70000-0x0000000075320000-memory.dmp

Download

memory/1168-55-0x0000000007BA0000-0x0000000007BBA000-memory.dmp

Download

memory/1168-54-0x0000000007A90000-0x0000000007AA4000-memory.dmp

Download

memory/1168-53-0x0000000007A80000-0x0000000007A8E000-memory.dmp

Download

memory/1168-52-0x0000000007A50000-0x0000000007A61000-memory.dmp

Download

memory/1168-51-0x0000000007AE0000-0x0000000007B76000-memory.dmp

Download

memory/1168-50-0x00000000078B0000-0x00000000078BA000-memory.dmp

Download

memory/1168-16-0x0000000002C30000-0x0000000002C66000-memory.dmp

Download

memory/1168-17-0x0000000074B70000-0x0000000075320000-memory.dmp

Download

memory/1168-18-0x00000000058F0000-0x0000000005F18000-memory.dmp

Download

memory/1168-19-0x0000000074B70000-0x0000000075320000-memory.dmp

Download

memory/1168-20-0x0000000005660000-0x0000000005682000-memory.dmp

Download

memory/1168-21-0x0000000005700000-0x0000000005766000-memory.dmp

Download

memory/1168-22-0x00000000057E0000-0x0000000005846000-memory.dmp

Download

memory/1168-49-0x0000000007850000-0x000000000786A000-memory.dmp

Download

memory/1168-32-0x0000000005F20000-0x0000000006274000-memory.dmp

Download

memory/1168-33-0x0000000006520000-0x000000000653E000-memory.dmp

Download

memory/1168-34-0x0000000006560000-0x00000000065AC000-memory.dmp

Download

memory/1168-35-0x0000000006B00000-0x0000000006B32000-memory.dmp

Download

memory/1168-36-0x00000000701C0000-0x000000007020C000-memory.dmp

Download

memory/1168-46-0x00000000076F0000-0x000000000770E000-memory.dmp

Download

memory/1168-48-0x0000000007E90000-0x000000000850A000-memory.dmp

Download

memory/1716-115-0x00000000701C0000-0x000000007020C000-memory.dmp

Download

memory/1884-132-0x0000000074B70000-0x0000000075320000-memory.dmp

Download

memory/1884-131-0x0000000074B70000-0x0000000075320000-memory.dmp

Download

memory/1884-15-0x0000000074B70000-0x0000000075320000-memory.dmp

Download

memory/1884-130-0x0000000074B70000-0x0000000075320000-memory.dmp

Download

memory/1884-11-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3444-4-0x00000000058D0000-0x00000000058DA000-memory.dmp

Download

memory/3444-10-0x000000000A8A0000-0x000000000A93C000-memory.dmp

Download

memory/3444-0-0x0000000074B7E000-0x0000000074B7F000-memory.dmp

Download

memory/3444-8-0x0000000006B50000-0x0000000006B60000-memory.dmp

Download

memory/3444-7-0x0000000006B40000-0x0000000006B4E000-memory.dmp

Download

memory/3444-5-0x0000000074B70000-0x0000000075320000-memory.dmp

Download

memory/3444-3-0x0000000005720000-0x00000000057B2000-memory.dmp

Download

memory/3444-9-0x0000000006B70000-0x0000000006BC6000-memory.dmp

Download

memory/3444-14-0x0000000074B70000-0x0000000075320000-memory.dmp

Download

memory/3444-2-0x0000000005CD0000-0x0000000006274000-memory.dmp

Download

memory/3444-6-0x0000000006B20000-0x0000000006B36000-memory.dmp

Download

memory/3444-1-0x0000000000CB0000-0x0000000000D3E000-memory.dmp

Download

memory/4596-72-0x00000000701C0000-0x000000007020C000-memory.dmp

Download

memory/4596-61-0x00000000054D0000-0x0000000005824000-memory.dmp

Download

memory/5016-94-0x00000000701C0000-0x000000007020C000-memory.dmp

Download

memory/5016-83-0x0000000006200000-0x0000000006554000-memory.dmp

Download