xworm | 2dc64216e7ec072466c632e59a4da4101fdf3e4499dabc36724c01434ff4442e

General

Target

XClient.exe
Size

64KB
MD5

f60efff1882f5dae9e31150e6296c87c
SHA1

e19beee5909878fec11967bda42ac2acb36a67ce
SHA256

2dc64216e7ec072466c632e59a4da4101fdf3e4499dabc36724c01434ff4442e
SHA512

ff705599a5f502a487308094b4366a920f9eb537177aca5f2e3ffbf292c7be5cd00fb38b39c679eb6bf6c3b9870fd5732dda6577fd64bfecfc5f46cabbdf9be9
SSDEEP

1536:vfNj1dXIR9JdlLx0l6rbzufGoZ6SxdgHO3A5l:hSfdpu4rbzQdAO3A5l

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:23386

cameras-happen.gl.at.ply.gg:23386

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1740-1-0x0000000000AD0000-0x0000000000AE6000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

1744 powershell.exe
2624 powershell.exe
3012 powershell.exe
1436 powershell.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1176 cmd.exe

pid	process
1744	powershell.exe
2624	powershell.exe
3012	powershell.exe
1436	powershell.exe

pid	process
1176	cmd.exe

Drops startup file 2 IoCs

Processes:

XClient.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
4	ip-api.com

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

XClient.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	XClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	XClient.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2024 timeout.exe

pid	process
2024	timeout.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

XClient.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	XClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	XClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate	XClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	XClient.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

1744 powershell.exe
2624 powershell.exe
3012 powershell.exe
1436 powershell.exe

pid	process
1744	powershell.exe
2624	powershell.exe
3012	powershell.exe
1436	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

XClient.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1740	XClient.exe
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeDebugPrivilege	2624	powershell.exe
Token: SeDebugPrivilege	3012	powershell.exe
Token: SeDebugPrivilege	1436	powershell.exe
Token: SeDebugPrivilege	1740	XClient.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

XClient.execmd.exe

description	pid	process	target process
PID 1740 wrote to memory of 1744	1740	XClient.exe	powershell.exe
PID 1740 wrote to memory of 1744	1740	XClient.exe	powershell.exe
PID 1740 wrote to memory of 1744	1740	XClient.exe	powershell.exe
PID 1740 wrote to memory of 2624	1740	XClient.exe	powershell.exe
PID 1740 wrote to memory of 2624	1740	XClient.exe	powershell.exe
PID 1740 wrote to memory of 2624	1740	XClient.exe	powershell.exe
PID 1740 wrote to memory of 3012	1740	XClient.exe	powershell.exe
PID 1740 wrote to memory of 3012	1740	XClient.exe	powershell.exe
PID 1740 wrote to memory of 3012	1740	XClient.exe	powershell.exe
PID 1740 wrote to memory of 1436	1740	XClient.exe	powershell.exe
PID 1740 wrote to memory of 1436	1740	XClient.exe	powershell.exe
PID 1740 wrote to memory of 1436	1740	XClient.exe	powershell.exe
PID 1740 wrote to memory of 1176	1740	XClient.exe	cmd.exe
PID 1740 wrote to memory of 1176	1740	XClient.exe	cmd.exe
PID 1740 wrote to memory of 1176	1740	XClient.exe	cmd.exe
PID 1176 wrote to memory of 2024	1176	cmd.exe	timeout.exe
PID 1176 wrote to memory of 2024	1176	cmd.exe	timeout.exe
PID 1176 wrote to memory of 2024	1176	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Drops startup file
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1744

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2624

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1436

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpB5D7.tmp.bat""
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1176

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:2024

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

3

T1082

Query Registry

2

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB5D7.tmp.bat
Filesize
159B

MD5
4086db906e64340b00633553a930cf09

SHA1
0af2bff701d476ee6ec2f183b86caee604b4b734

SHA256
46d53187a773ab9825777316ec0a2e63cd6631cd2d7285a6d16e5f3dfbce6446

SHA512
2adedd195566fa5516269847898c874c0eafab664752c61bdaa45c40965a87abd781ac4f82919729d1d518abb758373d27e8f813e008a5ffd7ff5e928effb077

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
459f683ed446ff0fc16d7a2152d83582

SHA1
98421219af9dc90e8f2e2076e17fe830a005054a

SHA256
358430cfbefa95687fd7fdcfbd88eabed3c35b6949d5754e3ae9de406855438f

SHA512
c3a107e0ff144816fe676ffe6681ed25eac37f121da58f10883face782df1e792806d459c1490fdcbccf5e92f7e2175ec61724e87ecb4f65e34e65ed8ffebf70

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1740-2-0x000007FEF5440000-0x000007FEF5E2C000-memory.dmp

Filesize
9.9MB

Download
memory/1740-0-0x000007FEF5443000-0x000007FEF5444000-memory.dmp

Filesize
4KB

Download
memory/1740-33-0x000007FEF5443000-0x000007FEF5444000-memory.dmp

Filesize
4KB

Download
memory/1740-34-0x000007FEF5440000-0x000007FEF5E2C000-memory.dmp

Filesize
9.9MB

Download
memory/1740-35-0x000000001A7E0000-0x000000001A7EC000-memory.dmp

Filesize
48KB

Download
memory/1740-1-0x0000000000AD0000-0x0000000000AE6000-memory.dmp

Filesize
88KB

Download
memory/1740-47-0x000007FEF5440000-0x000007FEF5E2C000-memory.dmp

Filesize
9.9MB

Download
memory/1744-7-0x0000000002C20000-0x0000000002CA0000-memory.dmp

Filesize
512KB

Download
memory/1744-8-0x000000001B580000-0x000000001B862000-memory.dmp

Filesize
2.9MB

Download
memory/1744-9-0x0000000001D90000-0x0000000001D98000-memory.dmp

Filesize
32KB

Download
memory/2624-15-0x000000001B4E0000-0x000000001B7C2000-memory.dmp

Filesize
2.9MB

Download
memory/2624-16-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads