xworm | e6bd9b2b687e9a2381b43d1fabeca64e5ed727676b5b9470220252e4098a22b6

Resubmissions

06/01/2025, 12:11

250106-pcnm1swlfz

11/06/2024, 17:39

240611-v8d2cavepb10

Analysis

max time kernel
146s
max time network
134s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 17:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nexus Release/Nexus Release V1.5.exe
Size 33.1MB
Sample240611-v8d2cavepb
SHA256 4763f3899de3f06d5598e165404dfb040d86961cb76c82fd153e9f8abff41712
MD5 44222f5b17b3cd5a6e0e9f3a8efce7ca
SHA1 3a7890ff8391ee849158ea1fa3fdd496ec00d3d7
SHA512 757da99975b8ce0efac615aea36d89811d0e3bdb47a94bd261ad28014d82c3d6d0b29ae9462240617fece6bc1686db4ef967faf51253488eccb827e7aa185307
SSDEEP 786432:mEpcxylSTtajAjj5Z2fQjcc54GqesS8sJpodQ+NWtPPAgnCaa:6WKjWO54GqesnssdQpwgnV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

91.92.241.69:5555

Attributes

Install_directory
%ProgramData%
install_file
Windows Runtime.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral5/files/0x0038000000016133-17.dat	family_xworm
behavioral5/memory/2748-43-0x0000000000030000-0x0000000000048000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3004	powershell.exe
1948	powershell.exe
3044	powershell.exe
1232	powershell.exe
2280	powershell.exe
2724	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Runtime.lnk	dllhost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Runtime.lnk	dllhost.exe

Executes dropped EXE 3 IoCs

pid	Process
2708	svchost.exe
2748	dllhost.exe
2088	nexus.exe

Loads dropped DLL 4 IoCs

pid	Process
2928	Nexus Release V1.5.exe
2928	Nexus Release V1.5.exe
2708	svchost.exe
2088	nexus.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Runtime = "C:\\ProgramData\\Windows Runtime.exe"	dllhost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
948	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2748	dllhost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1948	powershell.exe
3004	powershell.exe
2280	powershell.exe
2724	powershell.exe
3044	powershell.exe
1232	powershell.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeDebugPrivilege	2748	dllhost.exe
Token: SeDebugPrivilege	2280	powershell.exe
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeDebugPrivilege	3044	powershell.exe
Token: SeDebugPrivilege	1232	powershell.exe
Token: SeDebugPrivilege	2748	dllhost.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 3004	2928	Nexus Release V1.5.exe	28
PID 2928 wrote to memory of 3004	2928	Nexus Release V1.5.exe	28
PID 2928 wrote to memory of 3004	2928	Nexus Release V1.5.exe	28
PID 2928 wrote to memory of 3004	2928	Nexus Release V1.5.exe	28
PID 2928 wrote to memory of 1948	2928	Nexus Release V1.5.exe	30
PID 2928 wrote to memory of 1948	2928	Nexus Release V1.5.exe	30
PID 2928 wrote to memory of 1948	2928	Nexus Release V1.5.exe	30
PID 2928 wrote to memory of 1948	2928	Nexus Release V1.5.exe	30
PID 2928 wrote to memory of 2708	2928	Nexus Release V1.5.exe	32
PID 2928 wrote to memory of 2708	2928	Nexus Release V1.5.exe	32
PID 2928 wrote to memory of 2708	2928	Nexus Release V1.5.exe	32
PID 2928 wrote to memory of 2708	2928	Nexus Release V1.5.exe	32
PID 2928 wrote to memory of 2748	2928	Nexus Release V1.5.exe	33
PID 2928 wrote to memory of 2748	2928	Nexus Release V1.5.exe	33
PID 2928 wrote to memory of 2748	2928	Nexus Release V1.5.exe	33
PID 2928 wrote to memory of 2748	2928	Nexus Release V1.5.exe	33
PID 2708 wrote to memory of 2088	2708	svchost.exe	34
PID 2708 wrote to memory of 2088	2708	svchost.exe	34
PID 2708 wrote to memory of 2088	2708	svchost.exe	34
PID 2748 wrote to memory of 2280	2748	dllhost.exe	36
PID 2748 wrote to memory of 2280	2748	dllhost.exe	36
PID 2748 wrote to memory of 2280	2748	dllhost.exe	36
PID 2748 wrote to memory of 2724	2748	dllhost.exe	38
PID 2748 wrote to memory of 2724	2748	dllhost.exe	38
PID 2748 wrote to memory of 2724	2748	dllhost.exe	38
PID 2748 wrote to memory of 3044	2748	dllhost.exe	40
PID 2748 wrote to memory of 3044	2748	dllhost.exe	40
PID 2748 wrote to memory of 3044	2748	dllhost.exe	40
PID 2748 wrote to memory of 1232	2748	dllhost.exe	42
PID 2748 wrote to memory of 1232	2748	dllhost.exe	42
PID 2748 wrote to memory of 1232	2748	dllhost.exe	42
PID 2748 wrote to memory of 948	2748	dllhost.exe	44
PID 2748 wrote to memory of 948	2748	dllhost.exe	44
PID 2748 wrote to memory of 948	2748	dllhost.exe	44

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Nexus Release\Nexus Release V1.5.exe
"C:\Users\Admin\AppData\Local\Temp\Nexus Release\Nexus Release V1.5.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAcQBsACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGMAbABkACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcALgBnAGcALwBuAGUAeAB1AHMAbABvAGEAZABlAHIAIABSAHUAbgAgAEEAcwAgAEEAZABtAGkAbgAgAEkAZgAgAEkAbgBqAGUAYwB0AGkAbwBuACAARgBhAGkAbABzACcALAAnACcALAAnAE8ASwAnACwAJwBXAGEAcgBuAGkAbgBnACcAKQA8ACMAdwBmAGMAIwA+AA=="
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3004
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAZABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGMAcwB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGMAbABpACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGcAegBlACMAPgA="
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1948
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Users\Admin\AppData\Local\Temp\onefile_2708_133626012089468000\nexus.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2088
- C:\Users\Admin\AppData\Local\dllhost.exe
  "C:\Users\Admin\AppData\Local\dllhost.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\dllhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2280
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'dllhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2724
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Windows Runtime.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Runtime.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1232
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows Runtime" /tr "C:\ProgramData\Windows Runtime.exe"
    3⤵
    - Creates scheduled task(s)
    PID:948

C:\Windows\system32\taskeng.exe
taskeng.exe {90F9AB62-5CC4-400B-A5EC-7B770F868144} S-1-5-21-3691908287-3775019229-3534252667-1000:UOTHCPHQ\Admin:Interactive:[1]
1⤵
PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nexus.exe

Path C:\Users\Admin\AppData\Local\Temp\onefile_2708_133626012089468000\nexus.exe
Size 37.0MB
SHA256 41f7a63a0f786d751c009fe4b06b7c8755a7aaaf82a252da6878e0a1b967608d
MD5 a7940c3b4fa027664ab5c18bc794bf36
SHA1 b7a678427915eeb55b9da86c057a7fd3d61bdd15
SHA512 30fcc79f07123ac078177a69dc1ae4146934ae6f60e4317ac1183058da26bf69fbf23a4d5d5b1e788253ddfcbd0b8c932a4a41f47d78f8407bc4a14627e9fb1c
SSDEEP 196608:DO1z/dON1XsuNni4lErynr+J366zdYZczo+ucYXBD:IuBTl+67czo9cYX
MD5 SHA1 SHA512 SSDEEP

Submit Download

dllhost.exe

Path C:\Users\Admin\AppData\Local\dllhost.exe
Size 74KB
SHA256 49c175257966f191a2abce16d8533d359fc27ecf6512da870a9c59937914d5f7
MD5 cc7686bf7c7d81f59196d5cc3cab3348
SHA1 ac39079f223f87d404c421c48239f913b12f00a8
SHA512 940cfb37c1f5e5dbd86cc14d5a0a85dfaf889754051d4fc0d0afbe7bedceaec91b5f36b873b5e24cd081432db1b7d61df72a198681b9ab8e3a9b57197cfb58ae
SSDEEP 1536:IaMDvberZcH8cgbcfXijn1Q6VZAvO1krRCD:2Dva1cWbcPerEO1krRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 3e44dee44832a03ecbae0eaee1b7362192e524f0391ea5717cb32388963f6e37
MD5 db377c058c78675106c2b95f464dd61c
SHA1 70bf5e86b35d40a2aac5de4cb095d6474c9dee64
SHA512 bf1e85f5fd4d83a1a683a8469e5f92957e7be5a57617e90ff28898e3588e6029785ac93a1f2dca954c6a88461bed4d8b2ff1689e05b84b35e5191bedf178c524
SSDEEP 96:gJOCIQM8cnqvsqvJCwodJOCIQM8cnqvsEHyqvJCworCLKGQHhmx7sAXlUVg:A2QIUob2QIAHnorCr0+7sAj
MD5 SHA1 SHA512 SSDEEP

Submit Download

UROZ6ODLQB5IL4HTKQDZ.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UROZ6ODLQB5IL4HTKQDZ.temp
Size 7KB
SHA256 706fd5e2042798e05132c8cf6a5e144890719a660d4f76e7a403eab3aeb67ac5
MD5 4b9def1adb2421d8c27dc9b2ae3cea0e
SHA1 cf3e9ac2a0b28d8a8150f77c89ae3e336ca5759f
SHA512 c89ed29d9db96fb8b6a145884708e5d18f7c265d685b0ff5075008ce03401186d0c91f233aa7f87df4d4cd22bc7ca8d42d86cefaced16dc3be51b3204f62b993
SSDEEP 96:gJOCIQM8cnqvsqvJCwodJOCIQM8cnqvsEHyqvJCworlLS2QHlgm1g7sAXlUVg:A2QIUob2QIAHnorlvYgCg7sAj
MD5 SHA1 SHA512 SSDEEP

Submit Download

python310.dll

Path \Users\Admin\AppData\Local\Temp\onefile_2708_133626012089468000\python310.dll
Size 4.2MB
SHA256 f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8
MD5 384349987b60775d6fc3a6d202c3e1bd
SHA1 701cb80c55f859ad4a31c53aa744a00d61e467e5
SHA512 6bf3ef9f08f4fc07461b6ea8d9822568ad0a0f211e471b990f62c6713adb7b6be28b90f206a4ec0673b92bae99597d1c7785381e486f6091265c7df85ff0f9b5
SSDEEP 49152:+RYsIZfypUacEN7z1NR6JYL911cdl40pPQKE30tBuQS6BqL902zJAysI6maHmbM9:YYsI5xKZ4JxsvAI6xHEMb5Hs9d
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path \Users\Admin\AppData\Roaming\svchost.exe
Size 33.0MB
SHA256 bad905acaa547a246c37c06b39f0d6f473489a6a1900245548a6341a87bb8a77
MD5 28fdeaf0607d576de1b00981421e03c8
SHA1 71cad5e001a788429639eb721585a5cafbff488b
SHA512 915e9867450c4cd78ec42a779f4a53e86e4645a0c6f65a37d6818d086db2bc90afb116786a53daf041277eede1920053d083d548d6ba33314abf095887792bb0
SSDEEP 786432:P4e7SQ07lbcghmYr/6f5FfbWipHqIMy8AZj5HX7kaeVppOh+:Pv7SQ0ZbrUYrefBqUZj5HX7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2280-2077-0x000000001B5B0000-0x000000001B892000-memory.dmp

Download

memory/2280-2078-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

Download

memory/2724-2084-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

Download

memory/2724-2085-0x0000000001E00000-0x0000000001E08000-memory.dmp

Download

memory/2748-43-0x0000000000030000-0x0000000000048000-memory.dmp

Download