xworm | 10e56b1e7a68494d7d574c641b11f9d37b8dba5881c1e34d5337c93309162831

Analysis

max time kernel
143s
max time network
147s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
08/06/2024, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XClient.exe
Size 67KB
Sample240608-mlrd6aah4w
SHA256 10e56b1e7a68494d7d574c641b11f9d37b8dba5881c1e34d5337c93309162831
MD5 d79bc15ac6f6b3fd2349ada271729a31
SHA1 6d06d003db70ff628d98ce5b886e64e26e14d67b
SHA512 bac58eaf1580a531558276b5e4e3bd818bc8ca5f4f354c1c5249727b1e17e94681bdbb835910977ea0c1f22e9721cd51a2536811b729e3fb552464a6ad8cc1fb
SSDEEP 1536:FxH0BENHbI5gv/hENkYbpfl4o/6LinOclbHaP:4BucI/+bpLJOc16P
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

european-ba.gl.at.ply.gg:14522

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2236-1-0x0000000000F30000-0x0000000000F48000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2688	powershell.exe
2624	powershell.exe
2588	powershell.exe
1624	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	XClient.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2688	powershell.exe
2624	powershell.exe
2588	powershell.exe
1624	powershell.exe
2236	XClient.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2236	XClient.exe
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	2624	powershell.exe
Token: SeDebugPrivilege	2588	powershell.exe
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeDebugPrivilege	2236	XClient.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2236	XClient.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2688	2236	XClient.exe	29
PID 2236 wrote to memory of 2688	2236	XClient.exe	29
PID 2236 wrote to memory of 2688	2236	XClient.exe	29
PID 2236 wrote to memory of 2624	2236	XClient.exe	31
PID 2236 wrote to memory of 2624	2236	XClient.exe	31
PID 2236 wrote to memory of 2624	2236	XClient.exe	31
PID 2236 wrote to memory of 2588	2236	XClient.exe	33
PID 2236 wrote to memory of 2588	2236	XClient.exe	33
PID 2236 wrote to memory of 2588	2236	XClient.exe	33
PID 2236 wrote to memory of 1624	2236	XClient.exe	35
PID 2236 wrote to memory of 1624	2236	XClient.exe	35
PID 2236 wrote to memory of 1624	2236	XClient.exe	35

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 dc27e950c08ad3cb417ef63a6232d3a4cb4d43082501cda26d232bd2d178a394
MD5 a3333d39968fe66cbb42c460fc65acec
SHA1 2132d97237d71ab53a27c072f113cdce4ee6effc
SHA512 0396c58b840ebe5054161d1cb097f0d7426b03fe4438d9f64952fb0414e65e212c9546b573189bcc4ea44c2b9f3a3c0b834096833053beca0661c6743fd01f7c
SSDEEP 96:QFKCBM8knqvsqvJCwo2FKCBM8knqvsEHyqvJCwornpDYMQHgo7W+XlUVV:UD4UoWD4AHnornpbRo7W+W
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2236-0-0x000007FEF5DD3000-0x000007FEF5DD4000-memory.dmp

Download

memory/2236-1-0x0000000000F30000-0x0000000000F48000-memory.dmp

Download

memory/2236-2-0x000007FEF5DD0000-0x000007FEF67BC000-memory.dmp

Download

memory/2236-32-0x000007FEF5DD3000-0x000007FEF5DD4000-memory.dmp

Download

memory/2236-33-0x000007FEF5DD0000-0x000007FEF67BC000-memory.dmp

Download

memory/2624-15-0x000000001B670000-0x000000001B952000-memory.dmp

Download

memory/2624-16-0x0000000002790000-0x0000000002798000-memory.dmp

Download

memory/2688-7-0x0000000002C10000-0x0000000002C90000-memory.dmp

Download

memory/2688-8-0x000000001B680000-0x000000001B962000-memory.dmp

Download

memory/2688-9-0x0000000001E70000-0x0000000001E78000-memory.dmp

Download