xworm | cf5a0372c0667be70f46d879e0ed82af2423f7a08d80b65c6f8adb44a8586e9c

General

Target

LabyMod4.exe
Size

4.0MB
MD5

0bbe495d506dc3f4aa6ddfeab3b2621d
SHA1

a3d1a753a89d65347f1f6693dfc15753612ccb64
SHA256

cf5a0372c0667be70f46d879e0ed82af2423f7a08d80b65c6f8adb44a8586e9c
SHA512

a66afe1bbbbcbf9e10c30989afeadd6ea1ce3b3c67e2e464ab95616b602e9851e1ebc33c6356dd0241099781558b069f135ffcb021e399df9064fd01638925b9
SSDEEP

98304:8wz+aVyehU7iYSMF5cbP/5kJsPZ6NdZRM+9ylG5Mi:7+AbhU7iY9FQ5kSYX7MllGt

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

C2

cameras-happen.gl.at.ply.gg:23386

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral3/files/0x00060000000232b3-4.dat	family_xworm
behavioral3/memory/3188-17-0x00000000009E0000-0x0000000000A16000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1320	powershell.exe
2280	powershell.exe
1628	powershell.exe
2016	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	LabyMod4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	Ratka.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	Ratka.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	Ratka.exe

Executes dropped EXE 2 IoCs

pid	Process
3188	Ratka.exe
1204	Laby_Mod_4.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4012	timeout.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2280	powershell.exe
2280	powershell.exe
1628	powershell.exe
1628	powershell.exe
2016	powershell.exe
2016	powershell.exe
1320	powershell.exe
1320	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3188	Ratka.exe
Token: SeDebugPrivilege	1204	Laby_Mod_4.exe
Token: SeDebugPrivilege	2280	powershell.exe
Token: SeDebugPrivilege	1628	powershell.exe
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeDebugPrivilege	1320	powershell.exe
Token: SeDebugPrivilege	3188	Ratka.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 3188	4560	LabyMod4.exe	82
PID 4560 wrote to memory of 3188	4560	LabyMod4.exe	82
PID 4560 wrote to memory of 1204	4560	LabyMod4.exe	83
PID 4560 wrote to memory of 1204	4560	LabyMod4.exe	83
PID 4560 wrote to memory of 1204	4560	LabyMod4.exe	83
PID 3188 wrote to memory of 2280	3188	Ratka.exe	88
PID 3188 wrote to memory of 2280	3188	Ratka.exe	88
PID 3188 wrote to memory of 1628	3188	Ratka.exe	90
PID 3188 wrote to memory of 1628	3188	Ratka.exe	90
PID 3188 wrote to memory of 2016	3188	Ratka.exe	92
PID 3188 wrote to memory of 2016	3188	Ratka.exe	92
PID 3188 wrote to memory of 1320	3188	Ratka.exe	94
PID 3188 wrote to memory of 1320	3188	Ratka.exe	94
PID 3188 wrote to memory of 924	3188	Ratka.exe	98
PID 3188 wrote to memory of 924	3188	Ratka.exe	98
PID 924 wrote to memory of 4012	924	cmd.exe	100
PID 924 wrote to memory of 4012	924	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\LabyMod4.exe
"C:\Users\Admin\AppData\Local\Temp\LabyMod4.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Users\Admin\AppData\Local\Temp\Ratka.exe
  "C:\Users\Admin\AppData\Local\Temp\Ratka.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Ratka.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2280
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Ratka.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1628
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2016
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4E2B.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:924
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:4012
- C:\Users\Admin\AppData\Local\Temp\Laby_Mod_4.exe
  "C:\Users\Admin\AppData\Local\Temp\Laby_Mod_4.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bf3651a8682259b5e292b98289271f76

SHA1
4694a32734c377985dafbd15e26b9a129f1e4a45

SHA256
5ffc07abea05b9bb523e511ed75995488a22e3dd54fddc50b62b8336bd57c575

SHA512
d9cd369fc710131f0f24c3add83a923625831b1bfb4fba0da83dd71fa41a4ed5a0f0e00755f3cf8ae2aef4aa498c353348c51c167f7d6a2af834f07c78b33896

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
15dde0683cd1ca19785d7262f554ba93

SHA1
d039c577e438546d10ac64837b05da480d06bf69

SHA256
d6fa39eab7ee36f44dc3f9f2839d098433db95c1eba924e4bcf4e5c0d268d961

SHA512
57c0e1b87bc1c136f0d39f3ce64bb8f8274a0491e4ca6e45e5c7f9070aa9d9370c6f590ce37cd600b252df2638d870205249a514c43245ca7ed49017024a4672

Download Submit
C:\Users\Admin\AppData\Local\Temp\Laby_Mod_4.exe

Filesize
4.5MB

MD5
ff808f2bcef1b2d33eeee8678fa2c42d

SHA1
c1f640a45ee396f4dc70bb50ead02b0899a66122

SHA256
357d5e993e6ff9d91b2c49d4bc01a0aea465b737c0e8bc21b4cf21ff1a6824bb

SHA512
dff690c735b63fcadb0f981f792eed77f7c5af58b0f11f03d365bf3b75da04fb2898d48ab6621e979f5a81aa27856ddedef0949ef2e9bc1dcc98daf98b536b87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ratka.exe

Filesize
192KB

MD5
28b6f6405702915c6873e97bb0c2b9ca

SHA1
6ecbf035654ac5758073e15e1dba611397e5adad

SHA256
367f6ada7daf79724aa888bf211cd0a6f46fc082795456d67addeef8576ca431

SHA512
c2e93e96f5b537fe1919ca4a67ca02bb28c7bfa895148872d0df39a4a45aeb5433487784be930cc4b50e39ce7a24e9389c49e600e70f1d961fa5d0138f85cd0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i1yhgn0j.ze1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4E2B.tmp.bat

Filesize
157B

MD5
0c231f49f010e5c6643d85e85e9267ee

SHA1
5048458e294de4a1c36901c2898fbfa90b1e9b4d

SHA256
ff6f1cbf3d63ac5debd54bf83d6317b921bce7421be68fa5681765086d2187b9

SHA512
79ab91776a9bcd9f3d8669e527c5aaa0bed521a97c6217872a7d67eb17fdad9da472d361b5dbf99038b1118deeb679d652e74d254c64fa621a7894fe7cd2b91e

Download Submit
memory/1204-26-0x0000000074EBE000-0x0000000074EBF000-memory.dmp

Filesize
4KB

Download
memory/1204-85-0x0000000074EBE000-0x0000000074EBF000-memory.dmp

Filesize
4KB

Download
memory/1204-32-0x0000000074EB0000-0x0000000075660000-memory.dmp

Filesize
7.7MB

Download
memory/1204-33-0x0000000074EB0000-0x0000000075660000-memory.dmp

Filesize
7.7MB

Download
memory/1204-31-0x0000000005590000-0x000000000559A000-memory.dmp

Filesize
40KB

Download
memory/1204-30-0x0000000005660000-0x0000000005710000-memory.dmp

Filesize
704KB

Download
memory/1204-29-0x00000000055C0000-0x0000000005652000-memory.dmp

Filesize
584KB

Download
memory/1204-28-0x0000000005B70000-0x0000000006114000-memory.dmp

Filesize
5.6MB

Download
memory/1204-27-0x0000000000680000-0x0000000000B04000-memory.dmp

Filesize
4.5MB

Download
memory/1204-86-0x0000000074EB0000-0x0000000075660000-memory.dmp

Filesize
7.7MB

Download
memory/2280-35-0x0000025AF7870000-0x0000025AF7892000-memory.dmp

Filesize
136KB

Download
memory/3188-34-0x000000001B890000-0x000000001B8A0000-memory.dmp

Filesize
64KB

Download
memory/3188-17-0x00000000009E0000-0x0000000000A16000-memory.dmp

Filesize
216KB

Download
memory/3188-87-0x000000001B890000-0x000000001B8A0000-memory.dmp

Filesize
64KB

Download
memory/3188-14-0x00007FFFD45A3000-0x00007FFFD45A5000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing