xworm | 73a25e9ea9ab8041e1cf327ec49c93fccb61b740c671342d0988b4aea4234a0f

Analysis

max time kernel
121s
max time network
122s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
09/06/2024, 21:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
XClient (1).exe
Size 33KB
Sample240609-1c92ssfh46
SHA256 73a25e9ea9ab8041e1cf327ec49c93fccb61b740c671342d0988b4aea4234a0f
MD5 af9a6f5f38051152a45f8ed13920ba6a
SHA1 7aa9294f113642de5b85d7623cf022e23d8465b8
SHA512 1204ff66a9c87bd771dd7f9028d98713f035f2ca7d6827f9587869e3c7444481f45e4592ad8ec50c9ce1f7c7b2ad27057784630d74ba0b6e28610d77980d73d4
SSDEEP 768:qUa+vNohsXn42JiB702VF49j2eOjh7bD:BvNohsn4WiR08F49jFOj1v
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

20.ip.gl.ply.gg:17450

Mutex

L3VuRLbYt9e8whkS

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/5036-1-0x00000000004A0000-0x00000000004AE000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5036	XClient (1).exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4996	LogonUI.exe

C:\Users\Admin\AppData\Local\Temp\XClient (1).exe
"C:\Users\Admin\AppData\Local\Temp\XClient (1).exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5036

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3ae4055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5036-0-0x00007FFDC0CF3000-0x00007FFDC0CF4000-memory.dmp

Download

memory/5036-1-0x00000000004A0000-0x00000000004AE000-memory.dmp

Download

memory/5036-2-0x00007FFDC0CF0000-0x00007FFDC16DC000-memory.dmp

Download

memory/5036-3-0x00007FFDC0CF0000-0x00007FFDC16DC000-memory.dmp

Download

memory/5036-4-0x0000000002580000-0x000000000258C000-memory.dmp

Download

memory/5036-5-0x00007FFDC0CF0000-0x00007FFDC16DC000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads