xworm | ca6becc3a5e5b7fa151258c05c4b3a36bbfd470d347f8da494472988b4f7bb71

General

Target

LabyMod4Crt.exe
Size

62KB
MD5

e1135bf291dffcc3b904d29aabedf004
SHA1

2fc070053234cf8fc69361e8b8c8aa52c30c612f
SHA256

ca6becc3a5e5b7fa151258c05c4b3a36bbfd470d347f8da494472988b4f7bb71
SHA512

feb7819ffd99e068dad0ff9ac8cf8779e6a876c0f5e4926ccadc827c24543d74ab5a941e1a6f0078e5aa0011bef7901bc44508f0519afacc9b4e8cb42fbc2440
SSDEEP

1536:8L8ZxognvAhQtNGp1uBQt6buhGyWT6Q9FO2Ef5h:kgnfgp1uBQAbuEfO2s5h

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:23386

cameras-happen.gl.at.ply.gg:23386

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1752-1-0x0000000000C90000-0x0000000000CA6000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

2476 powershell.exe
2644 powershell.exe
2928 powershell.exe
2520 powershell.exe

pid	process
2476	powershell.exe
2644	powershell.exe
2928	powershell.exe
2520	powershell.exe

Drops startup file 2 IoCs

Processes:

LabyMod4Crt.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	LabyMod4Crt.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	LabyMod4Crt.exe

Loads dropped DLL 1 IoCs

Processes:

LabyMod4Crt.exe

pid process

1752 LabyMod4Crt.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

2476 powershell.exe
2644 powershell.exe
2928 powershell.exe
2520 powershell.exe

pid	process
1752	LabyMod4Crt.exe

flow	ioc
2	ip-api.com

pid	process
2476	powershell.exe
2644	powershell.exe
2928	powershell.exe
2520	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

LabyMod4Crt.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1752	LabyMod4Crt.exe
Token: SeDebugPrivilege	2476	powershell.exe
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	2520	powershell.exe
Token: SeDebugPrivilege	1752	LabyMod4Crt.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

LabyMod4Crt.exe

description	pid	process	target process
PID 1752 wrote to memory of 2476	1752	LabyMod4Crt.exe	powershell.exe
PID 1752 wrote to memory of 2476	1752	LabyMod4Crt.exe	powershell.exe
PID 1752 wrote to memory of 2476	1752	LabyMod4Crt.exe	powershell.exe
PID 1752 wrote to memory of 2644	1752	LabyMod4Crt.exe	powershell.exe
PID 1752 wrote to memory of 2644	1752	LabyMod4Crt.exe	powershell.exe
PID 1752 wrote to memory of 2644	1752	LabyMod4Crt.exe	powershell.exe
PID 1752 wrote to memory of 2928	1752	LabyMod4Crt.exe	powershell.exe
PID 1752 wrote to memory of 2928	1752	LabyMod4Crt.exe	powershell.exe
PID 1752 wrote to memory of 2928	1752	LabyMod4Crt.exe	powershell.exe
PID 1752 wrote to memory of 2520	1752	LabyMod4Crt.exe	powershell.exe
PID 1752 wrote to memory of 2520	1752	LabyMod4Crt.exe	powershell.exe
PID 1752 wrote to memory of 2520	1752	LabyMod4Crt.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\LabyMod4Crt.exe
"C:\Users\Admin\AppData\Local\Temp\LabyMod4Crt.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\LabyMod4Crt.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2476

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'LabyMod4Crt.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2644

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2928

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2520

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
f82eb1a87c16c6e92ee3c5d414293683

SHA1
7776795d435dd142d8a21e5dac6787a98e7131c2

SHA256
ceeb716275fbc7ef7068b7e166a1792627b977478cae21ed5d5bc69d45925b35

SHA512
654b6bf372213afe42fc1f782b82fd781a358be6570f3c85274cc930bd7cd9f907b518eb5c29af56309a74d0c4f78d6b33f89e5e0ed86d95314c55ade4f0b763

Download Submit
\Users\Admin\AppData\Local\Temp\tmpB97F.tmp
Filesize
100KB

MD5
1b942faa8e8b1008a8c3c1004ba57349

SHA1
cd99977f6c1819b12b33240b784ca816dfe2cb91

SHA256
555ccb7ecd9ae52a75135fdd81ab443a49d5785b0621ed6468d28c4234e46ccc

SHA512
5aee3d59478d41ddd5885c99b394c9c4983064e2b3528db1a3f7fc289662bced4f57d072517bbe7573c6d1789435e987ef1aa9cc91f372bcfd30bc016675fa43

Download Submit
memory/1752-31-0x0000000000BC0000-0x0000000000BCC000-memory.dmp

Filesize
48KB

Download
memory/1752-1-0x0000000000C90000-0x0000000000CA6000-memory.dmp

Filesize
88KB

Download
memory/1752-2-0x000007FEF5E40000-0x000007FEF682C000-memory.dmp

Filesize
9.9MB

Download
memory/1752-0-0x000007FEF5E43000-0x000007FEF5E44000-memory.dmp

Filesize
4KB

Download
memory/1752-33-0x0000000002230000-0x000000000226A000-memory.dmp

Filesize
232KB

Download
memory/1752-32-0x000007FEF5E40000-0x000007FEF682C000-memory.dmp

Filesize
9.9MB

Download
memory/1752-30-0x000007FEF5E43000-0x000007FEF5E44000-memory.dmp

Filesize
4KB

Download
memory/2476-7-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/2476-8-0x00000000022C0000-0x00000000022C8000-memory.dmp

Filesize
32KB

Download
memory/2644-15-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download
memory/2644-14-0x000000001B600000-0x000000001B8E2000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads