xworm | 267d1802344caba41d174d5e9750695c446724e6c480bee1b79100a64931e788

General

Target

Microsoft Network Realtime inspection.exe
Size

79KB
MD5

5c888eddae30076bd7aaa2e5d5fea097
SHA1

6a5b5c290d24bcd984a7083f934dbf35f56ec888
SHA256

267d1802344caba41d174d5e9750695c446724e6c480bee1b79100a64931e788
SHA512

4a17d517772d0efff6fea2074af232c90f47b370fa9269d36970bec3a8204e1e3df8f273f21287f712d26117a803b428ffd3683581b85498515e1d908c5b3dd1
SSDEEP

1536:y8p4oJOu7J3c+Fj4zo+ib+8qn36NOuCYh0uxqau:y5oJLJM5zJib+sOeh0uVu

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

listing-trackbacks.gl.at.ply.gg:15337

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Detect Xworm Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1656-1-0x0000000000F10000-0x0000000000F2A000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Roaming\TLauncher	family_xworm
behavioral1/memory/1828-34-0x00000000009C0000-0x00000000009DA000-memory.dmp	family_xworm
behavioral1/memory/1644-49-0x0000000001140000-0x000000000115A000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

2932 powershell.exe
1944 powershell.exe
2768 powershell.exe
2584 powershell.exe

pid	process
2932	powershell.exe
1944	powershell.exe
2768	powershell.exe
2584	powershell.exe

Drops startup file 2 IoCs

Processes:

Microsoft Network Realtime inspection.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TLauncher.lnk	Microsoft Network Realtime inspection.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TLauncher.lnk	Microsoft Network Realtime inspection.exe

Executes dropped EXE 3 IoCs

Processes:

TLaunchersurjpw.exeTLauncher

pid process

1828 TLauncher
1620 surjpw.exe
1644 TLauncher

pid	process
1828	TLauncher
1620	surjpw.exe
1644	TLauncher

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Microsoft Network Realtime inspection.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\TLauncher = "C:\\Users\\Admin\\AppData\\Roaming\\TLauncher"	Microsoft Network Realtime inspection.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2372 schtasks.exe

flow	ioc
4	ip-api.com

pid	process
2372	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeMicrosoft Network Realtime inspection.exe

pid	process
2768	powershell.exe
2584	powershell.exe
2932	powershell.exe
1944	powershell.exe
1656	Microsoft Network Realtime inspection.exe
1656	Microsoft Network Realtime inspection.exe
1656	Microsoft Network Realtime inspection.exe
1656	Microsoft Network Realtime inspection.exe
1656	Microsoft Network Realtime inspection.exe
1656	Microsoft Network Realtime inspection.exe
1656	Microsoft Network Realtime inspection.exe
1656	Microsoft Network Realtime inspection.exe
1656	Microsoft Network Realtime inspection.exe
1656	Microsoft Network Realtime inspection.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

Microsoft Network Realtime inspection.exepowershell.exepowershell.exepowershell.exepowershell.exeTLauncherTLaunchershutdown.exe

description	pid	process
Token: SeDebugPrivilege	1656	Microsoft Network Realtime inspection.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeDebugPrivilege	2584	powershell.exe
Token: SeDebugPrivilege	2932	powershell.exe
Token: SeDebugPrivilege	1944	powershell.exe
Token: SeDebugPrivilege	1656	Microsoft Network Realtime inspection.exe
Token: SeDebugPrivilege	1828	TLauncher
Token: SeDebugPrivilege	1644	TLauncher
Token: SeShutdownPrivilege	992	shutdown.exe
Token: SeRemoteShutdownPrivilege	992	shutdown.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

surjpw.exe

pid process

1620 surjpw.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

Microsoft Network Realtime inspection.exesurjpw.exe

pid process

1656 Microsoft Network Realtime inspection.exe
1620 surjpw.exe
1620 surjpw.exe
1620 surjpw.exe
1620 surjpw.exe
1620 surjpw.exe

pid	process
1620	surjpw.exe

pid	process
1656	Microsoft Network Realtime inspection.exe
1620	surjpw.exe
1620	surjpw.exe
1620	surjpw.exe
1620	surjpw.exe
1620	surjpw.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

Microsoft Network Realtime inspection.exetaskeng.exesurjpw.exe

description	pid	process	target process
PID 1656 wrote to memory of 2768	1656	Microsoft Network Realtime inspection.exe	powershell.exe
PID 1656 wrote to memory of 2768	1656	Microsoft Network Realtime inspection.exe	powershell.exe
PID 1656 wrote to memory of 2768	1656	Microsoft Network Realtime inspection.exe	powershell.exe
PID 1656 wrote to memory of 2584	1656	Microsoft Network Realtime inspection.exe	powershell.exe
PID 1656 wrote to memory of 2584	1656	Microsoft Network Realtime inspection.exe	powershell.exe
PID 1656 wrote to memory of 2584	1656	Microsoft Network Realtime inspection.exe	powershell.exe
PID 1656 wrote to memory of 2932	1656	Microsoft Network Realtime inspection.exe	powershell.exe
PID 1656 wrote to memory of 2932	1656	Microsoft Network Realtime inspection.exe	powershell.exe
PID 1656 wrote to memory of 2932	1656	Microsoft Network Realtime inspection.exe	powershell.exe
PID 1656 wrote to memory of 1944	1656	Microsoft Network Realtime inspection.exe	powershell.exe
PID 1656 wrote to memory of 1944	1656	Microsoft Network Realtime inspection.exe	powershell.exe
PID 1656 wrote to memory of 1944	1656	Microsoft Network Realtime inspection.exe	powershell.exe
PID 1656 wrote to memory of 2372	1656	Microsoft Network Realtime inspection.exe	schtasks.exe
PID 1656 wrote to memory of 2372	1656	Microsoft Network Realtime inspection.exe	schtasks.exe
PID 1656 wrote to memory of 2372	1656	Microsoft Network Realtime inspection.exe	schtasks.exe
PID 2160 wrote to memory of 1828	2160	taskeng.exe	TLauncher
PID 2160 wrote to memory of 1828	2160	taskeng.exe	TLauncher
PID 2160 wrote to memory of 1828	2160	taskeng.exe	TLauncher
PID 1656 wrote to memory of 1620	1656	Microsoft Network Realtime inspection.exe	surjpw.exe
PID 1656 wrote to memory of 1620	1656	Microsoft Network Realtime inspection.exe	surjpw.exe
PID 1656 wrote to memory of 1620	1656	Microsoft Network Realtime inspection.exe	surjpw.exe
PID 1656 wrote to memory of 1620	1656	Microsoft Network Realtime inspection.exe	surjpw.exe
PID 2160 wrote to memory of 1644	2160	taskeng.exe	TLauncher
PID 2160 wrote to memory of 1644	2160	taskeng.exe	TLauncher
PID 2160 wrote to memory of 1644	2160	taskeng.exe	TLauncher
PID 1620 wrote to memory of 992	1620	surjpw.exe	shutdown.exe
PID 1620 wrote to memory of 992	1620	surjpw.exe	shutdown.exe
PID 1620 wrote to memory of 992	1620	surjpw.exe	shutdown.exe
PID 1620 wrote to memory of 992	1620	surjpw.exe	shutdown.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe
"C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft Network Realtime inspection.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2768

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Microsoft Network Realtime inspection.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2584

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\TLauncher'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2932

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'TLauncher'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1944

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "TLauncher" /tr "C:\Users\Admin\AppData\Roaming\TLauncher"
2⤵
- Creates scheduled task(s)
PID:2372

C:\Users\Admin\AppData\Local\Temp\surjpw.exe
"C:\Users\Admin\AppData\Local\Temp\surjpw.exe"
2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\SysWOW64\shutdown.exe
shutdown -s -t 35
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:992

C:\Windows\system32\taskeng.exe
taskeng.exe {4F21F224-478D-4756-AE6B-391EE6333380} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2160

C:\Users\Admin\AppData\Roaming\TLauncher
C:\Users\Admin\AppData\Roaming\TLauncher
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1828

C:\Users\Admin\AppData\Roaming\TLauncher
C:\Users\Admin\AppData\Roaming\TLauncher
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1644

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\surjpw.exe
Filesize
500KB

MD5
07a9f858f9867f52163d7cec3bd899e3

SHA1
d7feae9f88b807606b747a27ac95ede57b2615f5

SHA256
0fde5da043382f46f04eaa04028fba0d127c20b87b88fbd7966805d5c93307ca

SHA512
e07185b51ea52aa9850beaa099a621383a06d452666e96b25e2f0a9f7152fe5f4dbcc8a75a6cb336ee80c4273f85d04abdc142e7d0f87a4f2a9b85a51036cb30

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
c66af3cea5c37ba1c23b06bed19318bb

SHA1
46aa55df21fe462729ee93a981136d070caa546e

SHA256
cd00e988d8a7d1bae825fb7c1fceb038fe933d669588ebfbaad28f9a3c7bf3f9

SHA512
3d8e689f3375e7ebb0284c6886a20ff96783762c3003eed87c194dbbca2c5f2a6491392ddf31370dc6ab0669b26948e89e48bb7e3f0fe23882a403912ff59f4a

Download Submit
C:\Users\Admin\AppData\Roaming\TLauncher
Filesize
79KB

MD5
5c888eddae30076bd7aaa2e5d5fea097

SHA1
6a5b5c290d24bcd984a7083f934dbf35f56ec888

SHA256
267d1802344caba41d174d5e9750695c446724e6c480bee1b79100a64931e788

SHA512
4a17d517772d0efff6fea2074af232c90f47b370fa9269d36970bec3a8204e1e3df8f273f21287f712d26117a803b428ffd3683581b85498515e1d908c5b3dd1

Download Submit
memory/1644-49-0x0000000001140000-0x000000000115A000-memory.dmp

Filesize
104KB

Download
memory/1656-1-0x0000000000F10000-0x0000000000F2A000-memory.dmp

Filesize
104KB

Download
memory/1656-2-0x000007FEF58A0000-0x000007FEF628C000-memory.dmp

Filesize
9.9MB

Download
memory/1656-0-0x000007FEF58A3000-0x000007FEF58A4000-memory.dmp

Filesize
4KB

Download
memory/1656-29-0x000007FEF58A3000-0x000007FEF58A4000-memory.dmp

Filesize
4KB

Download
memory/1656-30-0x000007FEF58A0000-0x000007FEF628C000-memory.dmp

Filesize
9.9MB

Download
memory/1828-34-0x00000000009C0000-0x00000000009DA000-memory.dmp

Filesize
104KB

Download
memory/2584-14-0x000000001B250000-0x000000001B532000-memory.dmp

Filesize
2.9MB

Download
memory/2584-15-0x0000000002490000-0x0000000002498000-memory.dmp

Filesize
32KB

Download
memory/2768-8-0x00000000023E0000-0x00000000023E8000-memory.dmp

Filesize
32KB

Download
memory/2768-7-0x000000001B290000-0x000000001B572000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads