Malware Analysis Report

2024-09-11 13:53

Sample ID 240615-f9amzstenl
Target Yarzakiybgz.exe
SHA256 17c1f9a31518a1aebdd3ec97dd872d936f763f41f69c7dd3b3724d7733f21586
Tags
xworm execution persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

17c1f9a31518a1aebdd3ec97dd872d936f763f41f69c7dd3b3724d7733f21586

Threat Level: Known bad

The file Yarzakiybgz.exe was found to be: Known bad.

Malicious Activity Summary

xworm execution persistence rat trojan

Xworm

Detect Xworm Payload

Command and Scripting Interpreter: PowerShell

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Adds Run key to start application

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Web Service
T1102
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-15 05:33

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-15 05:33

Reported

2024-06-15 05:35

Platform

win11-20240508-en

Max time kernel

59s

Max time network

60s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Yarzakiybgz.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\Docker \\.exe" C:\Users\Admin\AppData\Local\Temp\Yarzakiybgz.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Yarzakiybgz.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Yarzakiybgz.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Yarzakiybgz.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1488 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\Yarzakiybgz.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1488 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\Yarzakiybgz.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1488 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\Yarzakiybgz.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1488 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\Yarzakiybgz.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1488 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\Yarzakiybgz.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1488 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\Yarzakiybgz.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Yarzakiybgz.exe

"C:\Users\Admin\AppData\Local\Temp\Yarzakiybgz.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Yarzakiybgz.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Yarzakiybgz.exe'

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 8.8.8.8:53 pastebin.com udp

Files

memory/1488-0-0x0000000074D4E000-0x0000000074D4F000-memory.dmp

memory/1488-1-0x0000000000610000-0x0000000000AA4000-memory.dmp

memory/1488-2-0x0000000006750000-0x0000000006982000-memory.dmp

memory/1488-3-0x0000000006F30000-0x00000000074D6000-memory.dmp

memory/1488-4-0x0000000006A20000-0x0000000006AB2000-memory.dmp

memory/1488-22-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-24-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-50-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-48-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-68-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-66-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-64-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-62-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-58-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-56-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-54-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-52-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-46-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-60-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-44-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-42-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-40-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-38-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-36-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-32-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-30-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-28-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-26-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-16-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-14-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-12-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-10-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-8-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-6-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-35-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-20-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-18-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-5-0x0000000006750000-0x000000000697D000-memory.dmp

memory/1488-4891-0x0000000074D40000-0x00000000754F1000-memory.dmp

memory/1488-4892-0x0000000074D40000-0x00000000754F1000-memory.dmp

memory/1488-4893-0x0000000005510000-0x000000000557E000-memory.dmp

memory/1488-4894-0x0000000005580000-0x00000000055CC000-memory.dmp

memory/1488-4895-0x0000000006C80000-0x0000000006CD4000-memory.dmp

memory/1488-4897-0x0000000006CD0000-0x0000000006D04000-memory.dmp

memory/1488-4898-0x0000000006DD0000-0x0000000006E6C000-memory.dmp

memory/1488-4899-0x00000000075E0000-0x0000000007646000-memory.dmp

memory/1488-4900-0x0000000074D4E000-0x0000000074D4F000-memory.dmp

memory/2572-4901-0x0000000002490000-0x00000000024C6000-memory.dmp

memory/2572-4904-0x0000000074D40000-0x00000000754F1000-memory.dmp

memory/2572-4903-0x0000000004ED0000-0x00000000054FA000-memory.dmp

memory/2572-4905-0x0000000074D40000-0x00000000754F1000-memory.dmp

memory/2572-4902-0x0000000074D40000-0x00000000754F1000-memory.dmp

memory/2572-4906-0x00000000055F0000-0x0000000005612000-memory.dmp

memory/2572-4907-0x0000000005690000-0x00000000056F6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d4x5fypq.dy0.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2572-4916-0x0000000005770000-0x0000000005AC7000-memory.dmp

memory/2572-4917-0x0000000005C30000-0x0000000005C4E000-memory.dmp

memory/2572-4918-0x0000000005E10000-0x0000000005E5C000-memory.dmp

memory/2572-4919-0x0000000006BF0000-0x0000000006C24000-memory.dmp

memory/2572-4920-0x000000006FDA0000-0x000000006FDEC000-memory.dmp

memory/1488-4929-0x0000000074D40000-0x00000000754F1000-memory.dmp

memory/2572-4930-0x0000000006E30000-0x0000000006E4E000-memory.dmp

memory/2572-4931-0x0000000006E50000-0x0000000006EF4000-memory.dmp

memory/2572-4932-0x0000000074D40000-0x00000000754F1000-memory.dmp

memory/2572-4933-0x0000000074D40000-0x00000000754F1000-memory.dmp

memory/2572-4935-0x0000000006F80000-0x0000000006F9A000-memory.dmp

memory/2572-4934-0x00000000075D0000-0x0000000007C4A000-memory.dmp

memory/2572-4936-0x0000000006FF0000-0x0000000006FFA000-memory.dmp

memory/2572-4937-0x0000000007220000-0x00000000072B6000-memory.dmp

memory/2572-4938-0x0000000007190000-0x00000000071A1000-memory.dmp

memory/2572-4939-0x00000000071C0000-0x00000000071CE000-memory.dmp

memory/2572-4940-0x00000000071D0000-0x00000000071E5000-memory.dmp

memory/2572-4941-0x00000000072E0000-0x00000000072FA000-memory.dmp

memory/2572-4942-0x00000000072C0000-0x00000000072C8000-memory.dmp

memory/2572-4945-0x0000000074D40000-0x00000000754F1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

memory/1656-4947-0x00000000060C0000-0x0000000006417000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 8b113126b9112a7d707acbc8856bab55
SHA1 8a73218222bc62b3073a6f473f2f7e18b7b7cab2
SHA256 aeaa55bed69870c4676f8a7f2cb6df66ec52dfa9186c52cafecf7e50feadb846
SHA512 0713868c241e9bc199ae19b49d5a379cb347d725ec80c8f116706d7eb41e7a57b15922792d8a7a28ae2c83a5b1322fdafe166e47b331d4e05544031bad6c7148

memory/1656-4957-0x000000006FDA0000-0x000000006FDEC000-memory.dmp