Malware Analysis Report

2024-09-11 13:47

Sample ID 240614-ezzzfsvekh
Target main.rar
SHA256 aeab4b66da21ca4ff328d202cb2db093849448b968fa12099ff10f23e19dc60e
Tags
xworm execution rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

aeab4b66da21ca4ff328d202cb2db093849448b968fa12099ff10f23e19dc60e

Threat Level: Known bad

The file main.rar was found to be: Known bad.

Malicious Activity Summary

xworm execution rat trojan

Xworm

Detect Xworm Payload

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Unsigned PE

Enumerates physical storage devices

Creates scheduled task(s)

Suspicious behavior: AddClipboardFormatListener

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Scheduled Task/Job
T1053
Persistence
TA0003
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-14 04:23

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 04:23

Reported

2024-06-14 04:26

Platform

win11-20240611-en

Max time kernel

147s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\main\VapeProtecion.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\main\VapeProtecion.dll,#1

Network

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 04:23

Reported

2024-06-14 04:26

Platform

win11-20240611-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main\main.v1.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\vape.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\feds.lol.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\scvhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\scvhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\scvhost.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\vape.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\vape.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\vape.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\scvhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\scvhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\scvhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4556 wrote to memory of 32 N/A C:\Users\Admin\AppData\Local\Temp\main\main.v1.exe C:\Users\Admin\AppData\Roaming\vape.exe
PID 4556 wrote to memory of 32 N/A C:\Users\Admin\AppData\Local\Temp\main\main.v1.exe C:\Users\Admin\AppData\Roaming\vape.exe
PID 4556 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\main\main.v1.exe C:\Users\Admin\AppData\Roaming\feds.lol.exe
PID 4556 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\main\main.v1.exe C:\Users\Admin\AppData\Roaming\feds.lol.exe
PID 32 wrote to memory of 652 N/A C:\Users\Admin\AppData\Roaming\vape.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 32 wrote to memory of 652 N/A C:\Users\Admin\AppData\Roaming\vape.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 32 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Roaming\vape.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 32 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Roaming\vape.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 32 wrote to memory of 220 N/A C:\Users\Admin\AppData\Roaming\vape.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 32 wrote to memory of 220 N/A C:\Users\Admin\AppData\Roaming\vape.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 32 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Roaming\vape.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 32 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Roaming\vape.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 32 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Roaming\vape.exe C:\Windows\System32\schtasks.exe
PID 32 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Roaming\vape.exe C:\Windows\System32\schtasks.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\main\main.v1.exe

"C:\Users\Admin\AppData\Local\Temp\main\main.v1.exe"

C:\Users\Admin\AppData\Roaming\vape.exe

"C:\Users\Admin\AppData\Roaming\vape.exe"

C:\Users\Admin\AppData\Roaming\feds.lol.exe

"C:\Users\Admin\AppData\Roaming\feds.lol.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\vape.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'vape.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\scvhost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'scvhost.exe'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "scvhost" /tr "C:\Users\Admin\AppData\Roaming\scvhost.exe"

C:\Users\Admin\AppData\Roaming\scvhost.exe

C:\Users\Admin\AppData\Roaming\scvhost.exe

C:\Users\Admin\AppData\Roaming\scvhost.exe

C:\Users\Admin\AppData\Roaming\scvhost.exe

C:\Users\Admin\AppData\Roaming\scvhost.exe

C:\Users\Admin\AppData\Roaming\scvhost.exe

Network

Country Destination Domain Proto
GB 92.123.142.170:443 tcp
NL 23.62.61.97:443 r.bing.com tcp
NL 23.62.61.97:443 r.bing.com tcp
NL 23.62.61.97:443 r.bing.com tcp
NL 23.62.61.97:443 r.bing.com tcp
NL 23.62.61.97:443 r.bing.com tcp
NL 23.62.61.97:443 r.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 147.185.221.20:20443 gift-scientists.gl.at.ply.gg tcp
US 147.185.221.20:20443 gift-scientists.gl.at.ply.gg tcp
US 147.185.221.20:20443 gift-scientists.gl.at.ply.gg tcp
US 147.185.221.20:20443 gift-scientists.gl.at.ply.gg tcp
US 147.185.221.20:20443 gift-scientists.gl.at.ply.gg tcp

Files

memory/4556-0-0x00007FFBE9C73000-0x00007FFBE9C75000-memory.dmp

memory/4556-1-0x0000000000FB0000-0x00000000010F6000-memory.dmp

C:\Users\Admin\AppData\Roaming\vape.exe

MD5 409c4205d1119c67e3ed65c16f9b71c7
SHA1 2dd6c500f1bc16e59764cd1ac13642463efa52e7
SHA256 924d8102157fd6dbcda4cac2b035be62d8aeeb3e3d8d5bea167989a33d0141fd
SHA512 1de55f5dd34b546078130cb5619295113200d7fc254ef32573db256ece2ebc89181ff0cb92900617728f04a11d688d9b4bbd32b3152d1a66c9d93a206d1d135d

C:\Users\Admin\AppData\Roaming\feds.lol.exe

MD5 9a5bbfcfd9311824e175ab98a346770c
SHA1 8c1473c9513364779b35a7a65ed71ef4f321a180
SHA256 08a07606f1cace7f9c7c2578ffa15d1aeb0406841ad3e520a0cf02ddab1d9edf
SHA512 2845bd3c99ae36a15054c2dcf2bd93d069781cde18f96bd844c8814916f195de407ec1cbddf8c4d4f0c23003bf4dbc182dca1ac7a672235c1024895f2dd74148

memory/32-18-0x00000000007C0000-0x00000000007D6000-memory.dmp

memory/32-23-0x00007FFBE9C70000-0x00007FFBEA732000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1phtgnid.gu4.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/652-32-0x0000020339890000-0x00000203398B2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d0a4a3b9a52b8fe3b019f6cd0ef3dad6
SHA1 fed70ce7834c3b97edbd078eccda1e5effa527cd
SHA256 21942e513f223fdad778348fbb20617dd29f986bccd87824c0ae7f15649f3f31
SHA512 1a66f837b4e7fb6346d0500aeacb44902fb8a239bce23416271263eba46fddae58a17075e188ae43eb516c841e02c87e32ebd73256c7cc2c0713d00c35f1761b

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 856900844f6f1c326c89d0bcfb2f0c28
SHA1 1caad440d46fa8c0cbed4822b4be2bbdddba97c2
SHA256 ae24414ec53b3ae43ddbf1ff7b6643f8bf45281406f6415742f4305360d70a32
SHA512 ed8f421e151d797b33440dd0ddb6d6a5ec93fe7806ad82c60af3f77d545cf5dc319bce67804bd0613bb551a3f01648ec0d1918805dc7342145c8bb23ad12cab4

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 a7673410b995b49b300375100bbcb516
SHA1 7656933c6014d481f09df4d7026dc7f3b8a8e265
SHA256 c76be733d0b42861798d9f325123a19d56d99866cd17f791ae396a773471aaef
SHA512 6b51d7d143e069fd182407a4dc2e791eebfe72f84ae7ae57163b627b0e62e8acf0c86f9102a7697d1c8a31e6ee91020c9eb3c6de5f83eb71b2717dee158d629b

memory/32-67-0x00007FFBE9C70000-0x00007FFBEA732000-memory.dmp

memory/32-68-0x00007FFBE9C70000-0x00007FFBEA732000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\scvhost.exe.log

MD5 2cbbb74b7da1f720b48ed31085cbd5b8
SHA1 79caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
SHA512 ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9