xworm | be8b784930db373c77c4af35def8dd62bab00b25e7980a2198e6292610074aa6 | Triage™

Analysis

max time kernel
28s
max time network
16s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
09/06/2024, 20:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.exe
Size 164KB
Sample240609-zerskafd56
SHA256 be8b784930db373c77c4af35def8dd62bab00b25e7980a2198e6292610074aa6
MD5 1b33dca53f947f278fa3b529c0f8944f
SHA1 fbe808950fae84260c550c508425980fa4802b47
SHA512 db82d8d45a5eea758bb45e42d6fc24c61c43cace29c78621806fe40faa6c55fae6f3af40fa07a65a10787d5cf0af3e49eb765297a96314c0fcafc35d12a0bca6
SSDEEP 3072:Jr25iC8trURiqLmnHhc83FIwaLsnyJb5PMN/bS89jfz2:p25RYrUnLYHhwwaLsnyJb5PMP2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

h2cker.ddns.net:194
h2cker.ddns.net:0194

Mutex

XY4ZCM36bG2lfkJY

Attributes

Install_directory
%ProgramData%
install_file
Service.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral4/memory/4116-29-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Executes dropped EXE 1 IoCs

pid	Process
1664	LocalefUjwRZZGA.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Windows\CurrentVersion\Run\Service = "C:\\ProgramData\\Service.exe"	MSBuild.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1664 set thread context of 4116	1664	LocalefUjwRZZGA.exe	80

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task/Job

pid	Process
4268	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1664	LocalefUjwRZZGA.exe
1664	LocalefUjwRZZGA.exe
1664	LocalefUjwRZZGA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1664	LocalefUjwRZZGA.exe
Token: SeDebugPrivilege	4116	MSBuild.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 1664	4548	install.exe	78
PID 4548 wrote to memory of 1664	4548	install.exe	78
PID 1664 wrote to memory of 4116	1664	LocalefUjwRZZGA.exe	80
PID 1664 wrote to memory of 4116	1664	LocalefUjwRZZGA.exe	80
PID 1664 wrote to memory of 4116	1664	LocalefUjwRZZGA.exe	80
PID 1664 wrote to memory of 4116	1664	LocalefUjwRZZGA.exe	80
PID 1664 wrote to memory of 4116	1664	LocalefUjwRZZGA.exe	80
PID 1664 wrote to memory of 4116	1664	LocalefUjwRZZGA.exe	80
PID 1664 wrote to memory of 4116	1664	LocalefUjwRZZGA.exe	80
PID 1664 wrote to memory of 4116	1664	LocalefUjwRZZGA.exe	80
PID 4116 wrote to memory of 4268	4116	MSBuild.exe	81
PID 4116 wrote to memory of 4268	4116	MSBuild.exe	81
PID 4116 wrote to memory of 4268	4116	MSBuild.exe	81

C:\Users\Admin\AppData\Local\Temp\install.exe
"C:\Users\Admin\AppData\Local\Temp\install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Users\Admin\AppData\LocalefUjwRZZGA.exe
  "C:\Users\Admin\AppData\LocalefUjwRZZGA.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Service" /tr "C:\ProgramData\Service.exe"
      4⤵
      Creates scheduled task(s)
      PID:4268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LocalUMDWjUBbvf.exe

Path C:\Users\Admin\AppData\LocalUMDWjUBbvf.exe
Size 270B
SHA256 cbd4cd8faf323e43498462325d242d54b52b60550629491d118fbbc31fd64594
MD5 bd5ca3638a485637b6d24dbf73de9fe8
SHA1 afe95ea71ac7c16f0c12f44b20dde34d8eb8b0c3
SHA512 021f335e3f8ede8375fef50310a87ec54395f4392bbf95dec0cc2b7ef386ee3be6aae992fcae2236b5d25f2a4cadc2fb3333eda16dc6b1b8a65a937ebafb1884
MD5 SHA1 SHA512

Submit Download

LocalefUjwRZZGA.exe

Path C:\Users\Admin\AppData\LocalefUjwRZZGA.exe
Size 138KB
SHA256 54f2e357163305a265fd3cbd6bc287c1338e691a4e6975e1e9631b0ebddb920a
MD5 d0d7e34964fdf38d5465e5e3bad009fd
SHA1 dd081d07172fd96326a810ca2f93fed0eed0e086
SHA512 b9e81cc19b7b539fd74540a616876586d73bcc24a92d4ac9ccb552a51056832a22497ab6ef23b48360213dd8beeebcdf5fcbcc5ef96d2e050b974f416d60b7ee
SSDEEP 3072:Qr25iC8trURiqLmnHhc83FIwaLsnyJb5PMN/:c25RYrUnLYHhwwaLsnyJb5PM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1664-14-0x00007FFF1BBD3000-0x00007FFF1BBD5000-memory.dmp

Download

memory/1664-15-0x0000000000340000-0x000000000036C000-memory.dmp

Download

memory/1664-26-0x000000001AE20000-0x000000001AE2C000-memory.dmp

Download

memory/1664-28-0x00007FFF1BBD0000-0x00007FFF1C692000-memory.dmp

Download

memory/1664-31-0x00007FFF1BBD0000-0x00007FFF1C692000-memory.dmp

Download

memory/4116-29-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4116-32-0x0000000004E90000-0x0000000004F2C000-memory.dmp

Download

memory/4116-33-0x0000000004F30000-0x0000000004F96000-memory.dmp

Download

memory/4548-3-0x00007FFF1DFD0000-0x00007FFF1E971000-memory.dmp

Download

memory/4548-0-0x00007FFF1E285000-0x00007FFF1E286000-memory.dmp

Download

memory/4548-1-0x00007FFF1DFD0000-0x00007FFF1E971000-memory.dmp

Download

memory/4548-27-0x00007FFF1DFD0000-0x00007FFF1E971000-memory.dmp

Download