Malware Analysis Report

2024-09-11 13:45

Sample ID 240614-ccnlss1cqf
Target bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe
SHA256 bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76
Tags
xworm execution rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76

Threat Level: Known bad

The file bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe was found to be: Known bad.

Malicious Activity Summary

xworm execution rat trojan

Xworm

Detect Xworm Payload

Detects Windows executables referencing non-Windows User-Agents

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

Drops startup file

Checks computer location settings

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-14 01:56

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 01:56

Reported

2024-06-14 01:58

Platform

win7-20240508-en

Max time kernel

147s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2820 set thread context of 1816 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2820 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe
PID 2820 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe
PID 2820 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe
PID 2820 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe
PID 2820 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe
PID 2820 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe
PID 2820 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe
PID 2820 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe
PID 2820 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe
PID 2820 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe
PID 2820 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe
PID 2820 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe
PID 2820 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe
PID 2820 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe
PID 2820 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe
PID 2820 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe
PID 2820 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe
PID 2820 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe
PID 2820 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe
PID 2820 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe
PID 2820 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe
PID 1816 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1816 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1816 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1816 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1816 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1816 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1816 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1816 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1816 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1816 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1816 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1816 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1816 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1816 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1816 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1816 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe

"C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe"

C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe

"C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe"

C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe

"C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe"

C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe

"C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe"

C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe

"C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'

Network

Country Destination Domain Proto
DE 104.250.180.178:7061 tcp
DE 104.250.180.178:7061 tcp
DE 104.250.180.178:7061 tcp
DE 104.250.180.178:7061 tcp
DE 104.250.180.178:7061 tcp

Files

memory/2820-0-0x000000007458E000-0x000000007458F000-memory.dmp

memory/2820-1-0x0000000000270000-0x00000000002F2000-memory.dmp

memory/2820-2-0x0000000074580000-0x0000000074C6E000-memory.dmp

memory/2820-3-0x0000000000960000-0x000000000097A000-memory.dmp

memory/2820-4-0x00000000003B0000-0x00000000003C0000-memory.dmp

memory/2820-5-0x0000000007D70000-0x0000000007DC6000-memory.dmp

memory/1816-6-0x0000000000400000-0x0000000000414000-memory.dmp

memory/1816-9-0x0000000000400000-0x0000000000414000-memory.dmp

memory/1816-12-0x0000000000400000-0x0000000000414000-memory.dmp

memory/1816-7-0x0000000000400000-0x0000000000414000-memory.dmp

memory/1816-8-0x0000000000400000-0x0000000000414000-memory.dmp

memory/1816-16-0x0000000000400000-0x0000000000414000-memory.dmp

memory/1816-14-0x0000000000400000-0x0000000000414000-memory.dmp

memory/1816-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2820-17-0x0000000074580000-0x0000000074C6E000-memory.dmp

memory/1816-18-0x0000000074580000-0x0000000074C6E000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 873e1b614ad8915e6e2debba6b2a0b12
SHA1 5238a4003d7a7f91dff1296523b9c117c58c6c5b
SHA256 61e0e4c9c96762a33f57dce38d1e1147c856d001e1608d91431beb4ce61c0be3
SHA512 232f5236c26e4caf0094f3de858fb9c0be2d5ffe78e77661d5ff777bdef4002e99b6771b4f50e62595e91514cc344d0644c26be5b8044c53e4781cf1965bf9a9

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

\Users\Admin\AppData\Roaming\XClient.exe

MD5 79a3854fb0bddb26135bc0311f21ed76
SHA1 8c352e1807c00bd32c7cde3e0ece9bf33b6db927
SHA256 bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76
SHA512 2386b686b351f793d86db09e4a9a9bf39ffd0c7ec74ecc7e36ad78beeb092c97d0213dc628332df73856527768d95f507bc19e4b195bd06eec5305ac06f8d896

memory/1816-42-0x0000000074580000-0x0000000074C6E000-memory.dmp

memory/1816-43-0x0000000074580000-0x0000000074C6E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 01:56

Reported

2024-06-14 01:58

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3176 set thread context of 464 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3176 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe
PID 3176 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe
PID 3176 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe
PID 3176 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe
PID 3176 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe
PID 3176 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe
PID 3176 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe
PID 3176 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe
PID 464 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 464 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 464 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 464 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 464 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 464 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 464 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 464 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 464 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 464 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 464 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 464 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe

"C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe"

C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe

"C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe'

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 25.24.18.2.in-addr.arpa udp
DE 104.250.180.178:7061 tcp
US 8.8.8.8:53 178.180.250.104.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 233.17.178.52.in-addr.arpa udp

Files

memory/3176-0-0x000000007452E000-0x000000007452F000-memory.dmp

memory/3176-1-0x0000000000F30000-0x0000000000FB2000-memory.dmp

memory/3176-2-0x0000000005E50000-0x00000000063F4000-memory.dmp

memory/3176-3-0x00000000059A0000-0x0000000005A32000-memory.dmp

memory/3176-4-0x0000000074520000-0x0000000074CD0000-memory.dmp

memory/3176-5-0x0000000005B60000-0x0000000005B6A000-memory.dmp

memory/3176-6-0x0000000005E20000-0x0000000005E3A000-memory.dmp

memory/3176-7-0x0000000005CF0000-0x0000000005D00000-memory.dmp

memory/3176-8-0x0000000008840000-0x0000000008896000-memory.dmp

memory/3176-9-0x000000000AFA0000-0x000000000B03C000-memory.dmp

memory/464-10-0x0000000000400000-0x0000000000414000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\bad53d6e667f724563d9b42141bbcf279299b67c03db091c325e8e5597474f76.exe.log

MD5 8ec831f3e3a3f77e4a7b9cd32b48384c
SHA1 d83f09fd87c5bd86e045873c231c14836e76a05c
SHA256 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA512 26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

memory/464-13-0x0000000074520000-0x0000000074CD0000-memory.dmp

memory/3176-14-0x0000000074520000-0x0000000074CD0000-memory.dmp

memory/4668-15-0x0000000005260000-0x0000000005296000-memory.dmp

memory/4668-16-0x0000000074520000-0x0000000074CD0000-memory.dmp

memory/4668-17-0x0000000074520000-0x0000000074CD0000-memory.dmp

memory/4668-18-0x00000000058E0000-0x0000000005F08000-memory.dmp

memory/4668-19-0x0000000005F10000-0x0000000005F32000-memory.dmp

memory/4668-20-0x0000000005F40000-0x0000000005FA6000-memory.dmp

memory/4668-21-0x0000000005FB0000-0x0000000006016000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_djku2l5g.e1v.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4668-31-0x00000000063E0000-0x0000000006734000-memory.dmp

memory/4668-32-0x00000000061F0000-0x000000000620E000-memory.dmp

memory/4668-33-0x00000000069A0000-0x00000000069EC000-memory.dmp

memory/464-34-0x0000000074520000-0x0000000074CD0000-memory.dmp

memory/4668-35-0x0000000006F20000-0x0000000006F52000-memory.dmp

memory/4668-36-0x0000000070790000-0x00000000707DC000-memory.dmp

memory/4668-46-0x0000000006F00000-0x0000000006F1E000-memory.dmp

memory/4668-47-0x0000000007B30000-0x0000000007BD3000-memory.dmp

memory/4668-48-0x00000000082A0000-0x000000000891A000-memory.dmp

memory/4668-49-0x0000000007C60000-0x0000000007C7A000-memory.dmp

memory/4668-50-0x0000000007CD0000-0x0000000007CDA000-memory.dmp

memory/4668-51-0x0000000007EE0000-0x0000000007F76000-memory.dmp

memory/4668-52-0x0000000006D00000-0x0000000006D11000-memory.dmp

memory/4668-53-0x0000000074520000-0x0000000074CD0000-memory.dmp

memory/4668-54-0x0000000007E90000-0x0000000007E9E000-memory.dmp

memory/4668-55-0x0000000007EA0000-0x0000000007EB4000-memory.dmp

memory/4668-56-0x0000000007FA0000-0x0000000007FBA000-memory.dmp

memory/4668-57-0x0000000007F80000-0x0000000007F88000-memory.dmp

memory/4668-58-0x0000000074520000-0x0000000074CD0000-memory.dmp

memory/4668-61-0x0000000074520000-0x0000000074CD0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 5d2353e3220b37a8ae62ea93cc2baf4b
SHA1 97e450c0cadee28024209735e4bd6cbeab6e7c91
SHA256 54501072e71fb29e4d2402e0f9805c4313725f63669679b9b0ac05526a0812fc
SHA512 3e57613a944d887f09e928d3a01f55dec08c4976670701fc5c84ab9109c50d4b38950b8cf47f9f23fc6758f4d41c1fef157bc7b01b47078877d02638f4858e85

memory/964-73-0x0000000070790000-0x00000000707DC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 80e51371ecdaf223279b0c32fe90f386
SHA1 87bcda2b0f9f62b0b76274b97cfc1193af924ec2
SHA256 6f64f5228daac1984e352d8606bc9b0c4025bc1b7f271b3ed205001865ab8849
SHA512 f71e861129da595bce5aa74df59e089733a0db5f14ff0a56d751d7c4414419a505b79daa5d3ec747e97c94b1fc31a1954f30cf8598b10bc80f733f6749e29db9

memory/3204-94-0x0000000070790000-0x00000000707DC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 2d2ab62e1763a3353418b6e5fcebd998
SHA1 146fcceee5b732e74fc66fc18032d8e9f57b4e76
SHA256 d620ec8e7e0176ba8c148de1d3a7ad43cc0724cf4a42d6daf8a9cd0831f77e39
SHA512 cd792ae92f51705a1a5937730e72444f15c799d27752f4a50b6a47a5ca50ae9b4391ffce467822ab0b1e8efef7e4dbe72e432a5c828cf30ea24a7cabc4d68e92

memory/2184-115-0x0000000070790000-0x00000000707DC000-memory.dmp

memory/464-130-0x0000000074520000-0x0000000074CD0000-memory.dmp

memory/464-131-0x0000000074520000-0x0000000074CD0000-memory.dmp