xworm | 2b4e182346941bda5b768cb7ed97eeddc95a0ccb490ff60fa840fcc2af56ffe6

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 13:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2b4e182346941bda5b768cb7ed97eeddc95a0ccb490ff60fa840fcc2af56ffe6.exe
Size 67KB
Sample240612-qeba5swcnd
SHA256 2b4e182346941bda5b768cb7ed97eeddc95a0ccb490ff60fa840fcc2af56ffe6
MD5 a53085f566da131e85333f971652e3d6
SHA1 3b7ec64c7ffc429150abd7a827a993510477b142
SHA512 ae800ab0b46c5956511869948d21a7f60a6ea1236774a1cc9b71a702bd51ef14de605efa16ab36a5c1c2bd45ea807519de096baedae16900693d9c0eb460fddf
SSDEEP 1536:h6jdv08xPTOi7R5WZat5Wd5Skboxm1ZGEH266O6Ekor0F:hs6i7RFpkbox88EyO6FrF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

bay-cf.gl.at.ply.gg:20819:8848
188.254.126.46:8848

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1916-1-0x0000000001120000-0x0000000001138000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2976	powershell.exe
2708	powershell.exe
2764	powershell.exe
2740	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Roblox.lnk	2b4e182346941bda5b768cb7ed97eeddc95a0ccb490ff60fa840fcc2af56ffe6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Roblox.lnk	2b4e182346941bda5b768cb7ed97eeddc95a0ccb490ff60fa840fcc2af56ffe6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2976	powershell.exe
2708	powershell.exe
2764	powershell.exe
2740	powershell.exe
1916	2b4e182346941bda5b768cb7ed97eeddc95a0ccb490ff60fa840fcc2af56ffe6.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1916	2b4e182346941bda5b768cb7ed97eeddc95a0ccb490ff60fa840fcc2af56ffe6.exe
Token: SeDebugPrivilege	2976	powershell.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeDebugPrivilege	2740	powershell.exe
Token: SeDebugPrivilege	1916	2b4e182346941bda5b768cb7ed97eeddc95a0ccb490ff60fa840fcc2af56ffe6.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1916	2b4e182346941bda5b768cb7ed97eeddc95a0ccb490ff60fa840fcc2af56ffe6.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2976	1916	2b4e182346941bda5b768cb7ed97eeddc95a0ccb490ff60fa840fcc2af56ffe6.exe	28
PID 1916 wrote to memory of 2976	1916	2b4e182346941bda5b768cb7ed97eeddc95a0ccb490ff60fa840fcc2af56ffe6.exe	28
PID 1916 wrote to memory of 2976	1916	2b4e182346941bda5b768cb7ed97eeddc95a0ccb490ff60fa840fcc2af56ffe6.exe	28
PID 1916 wrote to memory of 2708	1916	2b4e182346941bda5b768cb7ed97eeddc95a0ccb490ff60fa840fcc2af56ffe6.exe	30
PID 1916 wrote to memory of 2708	1916	2b4e182346941bda5b768cb7ed97eeddc95a0ccb490ff60fa840fcc2af56ffe6.exe	30
PID 1916 wrote to memory of 2708	1916	2b4e182346941bda5b768cb7ed97eeddc95a0ccb490ff60fa840fcc2af56ffe6.exe	30
PID 1916 wrote to memory of 2764	1916	2b4e182346941bda5b768cb7ed97eeddc95a0ccb490ff60fa840fcc2af56ffe6.exe	32
PID 1916 wrote to memory of 2764	1916	2b4e182346941bda5b768cb7ed97eeddc95a0ccb490ff60fa840fcc2af56ffe6.exe	32
PID 1916 wrote to memory of 2764	1916	2b4e182346941bda5b768cb7ed97eeddc95a0ccb490ff60fa840fcc2af56ffe6.exe	32
PID 1916 wrote to memory of 2740	1916	2b4e182346941bda5b768cb7ed97eeddc95a0ccb490ff60fa840fcc2af56ffe6.exe	34
PID 1916 wrote to memory of 2740	1916	2b4e182346941bda5b768cb7ed97eeddc95a0ccb490ff60fa840fcc2af56ffe6.exe	34
PID 1916 wrote to memory of 2740	1916	2b4e182346941bda5b768cb7ed97eeddc95a0ccb490ff60fa840fcc2af56ffe6.exe	34

C:\Users\Admin\AppData\Local\Temp\2b4e182346941bda5b768cb7ed97eeddc95a0ccb490ff60fa840fcc2af56ffe6.exe
"C:\Users\Admin\AppData\Local\Temp\2b4e182346941bda5b768cb7ed97eeddc95a0ccb490ff60fa840fcc2af56ffe6.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2b4e182346941bda5b768cb7ed97eeddc95a0ccb490ff60fa840fcc2af56ffe6.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '2b4e182346941bda5b768cb7ed97eeddc95a0ccb490ff60fa840fcc2af56ffe6.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Roblox'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Roblox'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LFMTX0MWJCZSSAQDDH6D.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LFMTX0MWJCZSSAQDDH6D.temp
Size 7KB
SHA256 24398a41663a2e3586df02865bac523bc471f4a6b86a0df7f13485c735ea7e22
MD5 c4b9b1f9532348da8fef0c8b722d4f50
SHA1 d3dcf949bca09d295ecc16ee0511428e1aa17e7f
SHA512 12f2af542c20583d04d7df60b039e70d3aa74feea703a09959b9c3c9b094f6c457b4c76c419f5fddc0685fa1a596f1300cf52cdd4444645a53719cfadebcfee6
SSDEEP 96:NK1GCCFOM8QnqvsqvJCwofK1GCCFOM8QnqvsEHyqvJCworOkQGQHBd7brXlUVd:Y3kUoi3kAHnorOOEd7brS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1916-0-0x000007FEF5FB3000-0x000007FEF5FB4000-memory.dmp

Download

memory/1916-1-0x0000000001120000-0x0000000001138000-memory.dmp

Download

memory/1916-31-0x000000001AF40000-0x000000001AFC0000-memory.dmp

Download

memory/1916-32-0x000007FEF5FB3000-0x000007FEF5FB4000-memory.dmp

Download

memory/1916-33-0x000000001AF40000-0x000000001AFC0000-memory.dmp

Download

memory/2708-14-0x000000001B7C0000-0x000000001BAA2000-memory.dmp

Download

memory/2708-15-0x0000000001DE0000-0x0000000001DE8000-memory.dmp

Download

memory/2976-6-0x0000000002830000-0x00000000028B0000-memory.dmp

Download

memory/2976-7-0x000000001B590000-0x000000001B872000-memory.dmp

Download

memory/2976-8-0x00000000027E0000-0x00000000027E8000-memory.dmp

Download