xworm | 8f2d3eeab5e5d807acff4be9b7d6b41340f0c8a891baa094543d10e65ccec7f2

General

Target

Shellbag anylizer.exe
Size

69KB
MD5

a498059077fb136b7d57ef6f00dcae46
SHA1

77421f91ed2c1586419128bd4687241050d712cc
SHA256

8f2d3eeab5e5d807acff4be9b7d6b41340f0c8a891baa094543d10e65ccec7f2
SHA512

3bec766aa97ed8b89c8be1c4da89befc5f22217637f72d158753996b2ed74439cf485e7692f4f1fa522d31ceb608c86b9035e9c594fcb147a91edf4547ac14c3
SSDEEP

1536:bS3U8pWjIK2vvt8yAnkEZ6sPvWybW46zaQInA6dylkYcdOisYt2jNsXr:bWfWjXENk6wpbW4B9SSOisYsxer

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Attributes

Install_directory
%Temp%
install_file
svchost.exe
pastebin_url
https://pastebin.com/raw/qEVZXv39

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1940-1-0x0000000000030000-0x0000000000048000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2608	powershell.exe
2452	powershell.exe
1920	powershell.exe
2712	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	Shellbag anylizer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	Shellbag anylizer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe"	Shellbag anylizer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
6	pastebin.com
7	pastebin.com
8	2.tcp.eu.ngrok.io
16	2.tcp.eu.ngrok.io
53	2.tcp.eu.ngrok.io
60	2.tcp.eu.ngrok.io
22	2.tcp.eu.ngrok.io
29	2.tcp.eu.ngrok.io
33	2.tcp.eu.ngrok.io
39	2.tcp.eu.ngrok.io
45	2.tcp.eu.ngrok.io

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2712	powershell.exe
2608	powershell.exe
2452	powershell.exe
1920	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1940	Shellbag anylizer.exe
Token: SeDebugPrivilege	2712	powershell.exe
Token: SeDebugPrivilege	2608	powershell.exe
Token: SeDebugPrivilege	2452	powershell.exe
Token: SeDebugPrivilege	1920	powershell.exe
Token: SeDebugPrivilege	1940	Shellbag anylizer.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2712	1940	Shellbag anylizer.exe	29
PID 1940 wrote to memory of 2712	1940	Shellbag anylizer.exe	29
PID 1940 wrote to memory of 2712	1940	Shellbag anylizer.exe	29
PID 1940 wrote to memory of 2608	1940	Shellbag anylizer.exe	31
PID 1940 wrote to memory of 2608	1940	Shellbag anylizer.exe	31
PID 1940 wrote to memory of 2608	1940	Shellbag anylizer.exe	31
PID 1940 wrote to memory of 2452	1940	Shellbag anylizer.exe	33
PID 1940 wrote to memory of 2452	1940	Shellbag anylizer.exe	33
PID 1940 wrote to memory of 2452	1940	Shellbag anylizer.exe	33
PID 1940 wrote to memory of 1920	1940	Shellbag anylizer.exe	35
PID 1940 wrote to memory of 1920	1940	Shellbag anylizer.exe	35
PID 1940 wrote to memory of 1920	1940	Shellbag anylizer.exe	35

C:\Users\Admin\AppData\Local\Temp\Shellbag anylizer.exe
"C:\Users\Admin\AppData\Local\Temp\Shellbag anylizer.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Shellbag anylizer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Shellbag anylizer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WSINDOFZ97JZME40EKJ8.temp

Filesize
7KB

MD5
bf43bc87771ed6005d5e5b82df1e2c24

SHA1
544ecfb84aaa6e15631c6ba8ff28e2e837443514

SHA256
15d2da77f7e2aa7c0bb40af96eb6ad13f09d92dfaa74e914527cd2cf9b120a90

SHA512
3f3483b3b1166fc001c98f909bf0621759c9d8168542fb2b217b829e27c24797b9170f98d10faa84d0eb38f35eb9d3ecf628b05fb7dcadb734b54fb4896caeef

Download Submit
memory/1940-0-0x000007FEF5BD3000-0x000007FEF5BD4000-memory.dmp

Filesize
4KB

Download
memory/1940-1-0x0000000000030000-0x0000000000048000-memory.dmp

Filesize
96KB

Download
memory/1940-2-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

Filesize
9.9MB

Download
memory/1940-32-0x000007FEF5BD3000-0x000007FEF5BD4000-memory.dmp

Filesize
4KB

Download
memory/1940-33-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

Filesize
9.9MB

Download
memory/2608-15-0x000000001B7C0000-0x000000001BAA2000-memory.dmp

Filesize
2.9MB

Download
memory/2608-16-0x0000000001E00000-0x0000000001E08000-memory.dmp

Filesize
32KB

Download
memory/2712-7-0x00000000029D0000-0x0000000002A50000-memory.dmp

Filesize
512KB

Download
memory/2712-8-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/2712-9-0x0000000001F00000-0x0000000001F08000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads