xworm | 5caee4d3f535a1fd9f46149a69380c67b0d71af7bb4f3aedc9bd1860f5e8bca8

General

Target

Microsoft Network Realtime inspection.exe
Size

79KB
MD5

5c888eddae30076bd7aaa2e5d5fea097
SHA1

6a5b5c290d24bcd984a7083f934dbf35f56ec888
SHA256

267d1802344caba41d174d5e9750695c446724e6c480bee1b79100a64931e788
SHA512

4a17d517772d0efff6fea2074af232c90f47b370fa9269d36970bec3a8204e1e3df8f273f21287f712d26117a803b428ffd3683581b85498515e1d908c5b3dd1
SSDEEP

1536:y8p4oJOu7J3c+Fj4zo+ib+8qn36NOuCYh0uxqau:y5oJLJM5zJib+sOeh0uVu

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

listing-trackbacks.gl.at.ply.gg:15337

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Detect Xworm Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/836-1-0x0000000000BA0000-0x0000000000BBA000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Roaming\TLauncher	family_xworm
behavioral1/memory/2984-35-0x0000000000A30000-0x0000000000A4A000-memory.dmp	family_xworm
behavioral1/memory/900-39-0x00000000013C0000-0x00000000013DA000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

2656 powershell.exe
2888 powershell.exe
2776 powershell.exe
2992 powershell.exe

pid	process
2656	powershell.exe
2888	powershell.exe
2776	powershell.exe
2992	powershell.exe

Drops startup file 2 IoCs

Processes:

Microsoft Network Realtime inspection.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TLauncher.lnk	Microsoft Network Realtime inspection.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TLauncher.lnk	Microsoft Network Realtime inspection.exe

Executes dropped EXE 2 IoCs

Processes:

TLauncherTLauncher

pid process

2984 TLauncher
900 TLauncher

pid	process
2984	TLauncher
900	TLauncher

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Microsoft Network Realtime inspection.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\TLauncher = "C:\\Users\\Admin\\AppData\\Roaming\\TLauncher"	Microsoft Network Realtime inspection.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2600 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeMicrosoft Network Realtime inspection.exe

pid process

2656 powershell.exe
2888 powershell.exe
2776 powershell.exe
2992 powershell.exe
836 Microsoft Network Realtime inspection.exe

flow	ioc
4	ip-api.com

pid	process
2600	schtasks.exe

pid	process
2656	powershell.exe
2888	powershell.exe
2776	powershell.exe
2992	powershell.exe
836	Microsoft Network Realtime inspection.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

Microsoft Network Realtime inspection.exepowershell.exepowershell.exepowershell.exepowershell.exeTLauncherTLauncher

description	pid	process
Token: SeDebugPrivilege	836	Microsoft Network Realtime inspection.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	2888	powershell.exe
Token: SeDebugPrivilege	2776	powershell.exe
Token: SeDebugPrivilege	2992	powershell.exe
Token: SeDebugPrivilege	836	Microsoft Network Realtime inspection.exe
Token: SeDebugPrivilege	2984	TLauncher
Token: SeDebugPrivilege	900	TLauncher

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Microsoft Network Realtime inspection.exe

pid process

836 Microsoft Network Realtime inspection.exe

pid	process
836	Microsoft Network Realtime inspection.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

Microsoft Network Realtime inspection.exetaskeng.exe

description	pid	process	target process
PID 836 wrote to memory of 2656	836	Microsoft Network Realtime inspection.exe	powershell.exe
PID 836 wrote to memory of 2656	836	Microsoft Network Realtime inspection.exe	powershell.exe
PID 836 wrote to memory of 2656	836	Microsoft Network Realtime inspection.exe	powershell.exe
PID 836 wrote to memory of 2888	836	Microsoft Network Realtime inspection.exe	powershell.exe
PID 836 wrote to memory of 2888	836	Microsoft Network Realtime inspection.exe	powershell.exe
PID 836 wrote to memory of 2888	836	Microsoft Network Realtime inspection.exe	powershell.exe
PID 836 wrote to memory of 2776	836	Microsoft Network Realtime inspection.exe	powershell.exe
PID 836 wrote to memory of 2776	836	Microsoft Network Realtime inspection.exe	powershell.exe
PID 836 wrote to memory of 2776	836	Microsoft Network Realtime inspection.exe	powershell.exe
PID 836 wrote to memory of 2992	836	Microsoft Network Realtime inspection.exe	powershell.exe
PID 836 wrote to memory of 2992	836	Microsoft Network Realtime inspection.exe	powershell.exe
PID 836 wrote to memory of 2992	836	Microsoft Network Realtime inspection.exe	powershell.exe
PID 836 wrote to memory of 2600	836	Microsoft Network Realtime inspection.exe	schtasks.exe
PID 836 wrote to memory of 2600	836	Microsoft Network Realtime inspection.exe	schtasks.exe
PID 836 wrote to memory of 2600	836	Microsoft Network Realtime inspection.exe	schtasks.exe
PID 1568 wrote to memory of 2984	1568	taskeng.exe	TLauncher
PID 1568 wrote to memory of 2984	1568	taskeng.exe	TLauncher
PID 1568 wrote to memory of 2984	1568	taskeng.exe	TLauncher
PID 1568 wrote to memory of 900	1568	taskeng.exe	TLauncher
PID 1568 wrote to memory of 900	1568	taskeng.exe	TLauncher
PID 1568 wrote to memory of 900	1568	taskeng.exe	TLauncher

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe
"C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:836

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2656

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Microsoft Network Realtime inspection.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2888

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\TLauncher'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2776

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'TLauncher'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2992

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "TLauncher" /tr "C:\Users\Admin\AppData\Roaming\TLauncher"
2⤵
- Creates scheduled task(s)
PID:2600

C:\Windows\system32\taskeng.exe
taskeng.exe {59A897F0-0F07-49D0-B1F8-CED7D211373B} S-1-5-21-2737914667-933161113-3798636211-1000:PUMARTNR\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1568

C:\Users\Admin\AppData\Roaming\TLauncher
C:\Users\Admin\AppData\Roaming\TLauncher
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2984

C:\Users\Admin\AppData\Roaming\TLauncher
C:\Users\Admin\AppData\Roaming\TLauncher
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:900

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
1916d0fb90e458fb98492ec2a93fcc83

SHA1
0fe97ec3ebf1332873c16027393d4895fbbf97ec

SHA256
07fa42281e9f9aac80989bfaebcbe60739ba2c7a3e1684f0f2bd1f7787aac634

SHA512
3f9905ef4a3429397830be4a0cc0cb5102b71be00bf3d3efb77d2d2a57548e0b17c79de5ebf7a296e078decd4ee8cdc4479647071da33cb9e8fd30175d2e832e

Download Submit
C:\Users\Admin\AppData\Roaming\TLauncher
Filesize
79KB

MD5
5c888eddae30076bd7aaa2e5d5fea097

SHA1
6a5b5c290d24bcd984a7083f934dbf35f56ec888

SHA256
267d1802344caba41d174d5e9750695c446724e6c480bee1b79100a64931e788

SHA512
4a17d517772d0efff6fea2074af232c90f47b370fa9269d36970bec3a8204e1e3df8f273f21287f712d26117a803b428ffd3683581b85498515e1d908c5b3dd1

Download Submit
memory/836-30-0x000007FEF5633000-0x000007FEF5634000-memory.dmp

Filesize
4KB

Download
memory/836-2-0x000007FEF5630000-0x000007FEF601C000-memory.dmp

Filesize
9.9MB

Download
memory/836-0-0x000007FEF5633000-0x000007FEF5634000-memory.dmp

Filesize
4KB

Download
memory/836-31-0x000007FEF5630000-0x000007FEF601C000-memory.dmp

Filesize
9.9MB

Download
memory/836-1-0x0000000000BA0000-0x0000000000BBA000-memory.dmp

Filesize
104KB

Download
memory/836-37-0x000000001AB30000-0x000000001AB3C000-memory.dmp

Filesize
48KB

Download
memory/900-39-0x00000000013C0000-0x00000000013DA000-memory.dmp

Filesize
104KB

Download
memory/2656-7-0x0000000002950000-0x00000000029D0000-memory.dmp

Filesize
512KB

Download
memory/2656-8-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/2656-9-0x00000000020D0000-0x00000000020D8000-memory.dmp

Filesize
32KB

Download
memory/2888-15-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/2888-16-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/2984-35-0x0000000000A30000-0x0000000000A4A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads