xworm | daafb00382eccadaf2f91f5cdf9495db9f3c7245aebe3905bb4637909c58a2e0

Analysis

max time kernel
33s
max time network
32s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
15/06/2024, 04:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XClient.exe
Size 45KB
Sample240615-fl3c4azblb
SHA256 daafb00382eccadaf2f91f5cdf9495db9f3c7245aebe3905bb4637909c58a2e0
MD5 1ea7fa570588a032058606fb7e020a3b
SHA1 e65850b6abc138b93a9810ae03d20ff3109a52cc
SHA512 e952652c2385e39d670b68aa14be28a04687b1bf036af116be7310eb1af0e6a9bbc3990803f109d145e79c37d2f043d98b60f23b5affdd29555caae193fb5e95
SSDEEP 768:YaQmwcZlyOArAloVIpfVrzPmFEPa9BbkR6cOFhVzwtE/:NwGl3VfliFd9x86cOFPX/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

Version

Mutex

DSLw1tuN6TXiQSJh

Attributes

Install_directory
%ProgramData%
install_file
rundll64.exe
pastebin_url
https://pastebin.com/raw/EiiXCJbn

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/memory/1572-1-0x00000000003B0000-0x00000000003C2000-memory.dmp	family_xworm
behavioral1/files/0x000700000002aa19-53.dat	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4544	powershell.exe
2376	powershell.exe
3444	powershell.exe
2264	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2508	rundll64.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	pastebin.com
4	pastebin.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3020	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3444	powershell.exe
3444	powershell.exe
2264	powershell.exe
2264	powershell.exe
4544	powershell.exe
4544	powershell.exe
2376	powershell.exe
2376	powershell.exe
1572	XClient.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1572	XClient.exe
Token: SeDebugPrivilege	3444	powershell.exe
Token: SeDebugPrivilege	2264	powershell.exe
Token: SeDebugPrivilege	4544	powershell.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeDebugPrivilege	1572	XClient.exe
Token: SeDebugPrivilege	2508	rundll64.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1572	XClient.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 3444	1572	XClient.exe	83
PID 1572 wrote to memory of 3444	1572	XClient.exe	83
PID 1572 wrote to memory of 2264	1572	XClient.exe	85
PID 1572 wrote to memory of 2264	1572	XClient.exe	85
PID 1572 wrote to memory of 4544	1572	XClient.exe	87
PID 1572 wrote to memory of 4544	1572	XClient.exe	87
PID 1572 wrote to memory of 2376	1572	XClient.exe	89
PID 1572 wrote to memory of 2376	1572	XClient.exe	89
PID 1572 wrote to memory of 3020	1572	XClient.exe	91
PID 1572 wrote to memory of 3020	1572	XClient.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\rundll64.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'rundll64.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2376
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "rundll64" /tr "C:\ProgramData\rundll64.exe"
  2⤵
  - Creates scheduled task(s)
  PID:3020

C:\ProgramData\rundll64.exe
C:\ProgramData\rundll64.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rundll64.exe

Path C:\ProgramData\rundll64.exe
Size 45KB
SHA256 daafb00382eccadaf2f91f5cdf9495db9f3c7245aebe3905bb4637909c58a2e0
MD5 1ea7fa570588a032058606fb7e020a3b
SHA1 e65850b6abc138b93a9810ae03d20ff3109a52cc
SHA512 e952652c2385e39d670b68aa14be28a04687b1bf036af116be7310eb1af0e6a9bbc3990803f109d145e79c37d2f043d98b60f23b5affdd29555caae193fb5e95
SSDEEP 768:YaQmwcZlyOArAloVIpfVrzPmFEPa9BbkR6cOFhVzwtE/:NwGl3VfliFd9x86cOFPX/
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888
MD5 1a9fa92a4f2e2ec9e244d43a6a4f8fb9
SHA1 9910190edfaccece1dfcc1d92e357772f5dae8f7
SHA512 5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 1ab4ae61b4737b190193187b1aeab9be32401753022b5e739023bea857edd9c7
MD5 f1ed0ca7585ba163098d9e724addbab2
SHA1 1bfbaa9b7e1d4211c65a421bc4a760d4eb72c196
SHA512 0738b9346203da57bd44a34c289e7b2013bb7e6de398cd8e859bbab6971e40ef0ff5b41a9c5a24ffb889564e730cc16b275272917841a61cb87790bbb69af573
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 adffc75eb7bb7c89fd7d718c872d2e1f26a843f9696ca4025d9426ffd9f13ebf
MD5 235a07b025b2b08ad72a3334b8d3d31c
SHA1 db17747d857bb685c444c6dcb443cf776ba26510
SHA512 c8e2af527e9d32f2cab596e3f4beef531c75729c32537a5e1b5019e9cd9c8b179a3bc86a720f77d8c68a8702ae66e2e923e36feda5588cc44b2f09264beb8855
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_kuks1rgu.ppk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kuks1rgu.ppk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/1572-1-0x00000000003B0000-0x00000000003C2000-memory.dmp

Download

memory/1572-2-0x00007FF92ECD0000-0x00007FF92F792000-memory.dmp

Download

memory/1572-56-0x000000001BD90000-0x000000001BD9C000-memory.dmp

Download

memory/1572-0-0x00007FF92ECD3000-0x00007FF92ECD5000-memory.dmp

Download

memory/1572-52-0x00007FF92ECD0000-0x00007FF92F792000-memory.dmp

Download

memory/3444-4-0x00007FF92ECD0000-0x00007FF92F792000-memory.dmp

Download

memory/3444-19-0x00007FF92ECD0000-0x00007FF92F792000-memory.dmp

Download

memory/3444-16-0x00007FF92ECD0000-0x00007FF92F792000-memory.dmp

Download

memory/3444-15-0x00007FF92ECD0000-0x00007FF92F792000-memory.dmp

Download

memory/3444-13-0x00000221D6690000-0x00000221D66B2000-memory.dmp

Download

memory/3444-14-0x00007FF92ECD0000-0x00007FF92F792000-memory.dmp

Download

memory/3444-3-0x00007FF92ECD0000-0x00007FF92F792000-memory.dmp

Download