xworm | 6666c3ef1bb36779fd6725d4ec308dd4a5a7677931844691d1d3fdba46c3278f

Analysis

max time kernel
139s
max time network
153s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
21/06/2024, 06:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
main.v1.exe
Size 1.2MB
Sample240621-gsa3vstdpj
SHA256 6666c3ef1bb36779fd6725d4ec308dd4a5a7677931844691d1d3fdba46c3278f
MD5 dc34a8f3b65df10c070951e4badc0dc4
SHA1 cf3f53df78152e416ae517dd09a2d8e874c3cb05
SHA512 a52afa789dc5ac42c50a2364c2d9e8138aaee833ac4e266f99473a01412e46fcbfa3351adf538ec023df13234203b90c0b8d3e429155b4515da1210657f9e008
SSDEEP 24576:vGjmmvk+tKHCeYhDM/gRZGJ1FkRlqY3Jna5ptgJBXc1mz7MljDBdUaUk/0nF:+6mvoieODMo/GJQoYpantgbv81ck0n
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

gift-scientists.gl.at.ply.gg:20443

Attributes

Install_directory
%AppData%
install_file
scvhost.exe

Signatures

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral1/files/0x000d00000001226d-6.dat	family_xworm
behavioral1/memory/2068-7-0x0000000001110000-0x0000000001126000-memory.dmp	family_xworm
behavioral1/memory/3000-42-0x0000000000CE0000-0x0000000000CF6000-memory.dmp	family_xworm
behavioral1/memory/992-48-0x0000000001140000-0x0000000001156000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2952	powershell.exe
1992	powershell.exe
1996	powershell.exe
2172	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
2068	vape.exe
2136	feds.lol.exe
3000	scvhost.exe
992	scvhost.exe
2396	scvhost.exe

Loads dropped DLL 1 IoCs

pid	Process
2392	main.v1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2860	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2068	vape.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2952	powershell.exe
1992	powershell.exe
1996	powershell.exe
2172	powershell.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2068	vape.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	1992	powershell.exe
Token: SeDebugPrivilege	1996	powershell.exe
Token: SeDebugPrivilege	2172	powershell.exe
Token: SeDebugPrivilege	2068	vape.exe
Token: SeDebugPrivilege	3000	scvhost.exe
Token: SeDebugPrivilege	2992	taskmgr.exe
Token: SeDebugPrivilege	992	scvhost.exe
Token: SeDebugPrivilege	2396	scvhost.exe

Suspicious use of FindShellTrayWindow 30 IoCs

pid	Process
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe
2992	taskmgr.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2068	2392	main.v1.exe	28
PID 2392 wrote to memory of 2068	2392	main.v1.exe	28
PID 2392 wrote to memory of 2068	2392	main.v1.exe	28
PID 2392 wrote to memory of 2136	2392	main.v1.exe	29
PID 2392 wrote to memory of 2136	2392	main.v1.exe	29
PID 2392 wrote to memory of 2136	2392	main.v1.exe	29
PID 2068 wrote to memory of 2952	2068	vape.exe	31
PID 2068 wrote to memory of 2952	2068	vape.exe	31
PID 2068 wrote to memory of 2952	2068	vape.exe	31
PID 2068 wrote to memory of 1992	2068	vape.exe	33
PID 2068 wrote to memory of 1992	2068	vape.exe	33
PID 2068 wrote to memory of 1992	2068	vape.exe	33
PID 2068 wrote to memory of 1996	2068	vape.exe	35
PID 2068 wrote to memory of 1996	2068	vape.exe	35
PID 2068 wrote to memory of 1996	2068	vape.exe	35
PID 2068 wrote to memory of 2172	2068	vape.exe	37
PID 2068 wrote to memory of 2172	2068	vape.exe	37
PID 2068 wrote to memory of 2172	2068	vape.exe	37
PID 2068 wrote to memory of 2860	2068	vape.exe	39
PID 2068 wrote to memory of 2860	2068	vape.exe	39
PID 2068 wrote to memory of 2860	2068	vape.exe	39
PID 2908 wrote to memory of 3000	2908	taskeng.exe	42
PID 2908 wrote to memory of 3000	2908	taskeng.exe	42
PID 2908 wrote to memory of 3000	2908	taskeng.exe	42
PID 2908 wrote to memory of 992	2908	taskeng.exe	49
PID 2908 wrote to memory of 992	2908	taskeng.exe	49
PID 2908 wrote to memory of 992	2908	taskeng.exe	49
PID 2908 wrote to memory of 2396	2908	taskeng.exe	50
PID 2908 wrote to memory of 2396	2908	taskeng.exe	50
PID 2908 wrote to memory of 2396	2908	taskeng.exe	50

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\main.v1.exe
"C:\Users\Admin\AppData\Local\Temp\main.v1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Users\Admin\AppData\Roaming\vape.exe
  "C:\Users\Admin\AppData\Roaming\vape.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\vape.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'vape.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1992
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\scvhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'scvhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2172
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "scvhost" /tr "C:\Users\Admin\AppData\Roaming\scvhost.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2860
- C:\Users\Admin\AppData\Roaming\feds.lol.exe
  "C:\Users\Admin\AppData\Roaming\feds.lol.exe"
  2⤵
  - Executes dropped EXE
  PID:2136

C:\Windows\system32\taskeng.exe
taskeng.exe {E8D0BF94-57D5-4FB7-AF4C-73CD78216FA8} S-1-5-21-39690363-730359138-1046745555-1000:EILATWEW\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Users\Admin\AppData\Roaming\scvhost.exe
  C:\Users\Admin\AppData\Roaming\scvhost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3000
- C:\Users\Admin\AppData\Roaming\scvhost.exe
  C:\Users\Admin\AppData\Roaming\scvhost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:992
- C:\Users\Admin\AppData\Roaming\scvhost.exe
  C:\Users\Admin\AppData\Roaming\scvhost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2396

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:788

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 1967a247c5ee459516a2590bb1f083312bced705ded1ab8bb47fce7ca3cd67c1
MD5 b60058ba4e3b18ece7ac51b76ff093b6
SHA1 fbc775c0f439691e91724997d754a31453e67242
SHA512 40d21e5c5e1995ca9e31a0e783d45f7cf0163e5eb86d6062f3ab564b9253205d0483925de530c12cdc02b6f81d4faf0ee1e5705f90b88f1d511d3d4021948249
SSDEEP 96:wleCpM8VnqvsqvJCwohleCpM8VnqvsEHyqvJCworX+kVQH3Q790XlUVE:UvJUoDvJAHnorXn6Q790z
MD5 SHA1 SHA512 SSDEEP

Submit Download

vape.exe

Path C:\Users\Admin\AppData\Roaming\vape.exe
Size 61KB
SHA256 924d8102157fd6dbcda4cac2b035be62d8aeeb3e3d8d5bea167989a33d0141fd
MD5 409c4205d1119c67e3ed65c16f9b71c7
SHA1 2dd6c500f1bc16e59764cd1ac13642463efa52e7
SHA512 1de55f5dd34b546078130cb5619295113200d7fc254ef32573db256ece2ebc89181ff0cb92900617728f04a11d688d9b4bbd32b3152d1a66c9d93a206d1d135d
SSDEEP 768:gDifR2nzIdDiIp2PhtWZRYs/b1NnW9bnj5jWzNd6RuhO0utthei4Jq8Z:d2sdgh4b/b7835aJd6gO0at43J9
MD5 SHA1 SHA512 SSDEEP

Submit Download

feds.lol.exe

Path \Users\Admin\AppData\Roaming\feds.lol.exe
Size 1.2MB
SHA256 08a07606f1cace7f9c7c2578ffa15d1aeb0406841ad3e520a0cf02ddab1d9edf
MD5 9a5bbfcfd9311824e175ab98a346770c
SHA1 8c1473c9513364779b35a7a65ed71ef4f321a180
SHA512 2845bd3c99ae36a15054c2dcf2bd93d069781cde18f96bd844c8814916f195de407ec1cbddf8c4d4f0c23003bf4dbc182dca1ac7a672235c1024895f2dd74148
SSDEEP 24576:W0V1DZAnKaZjHKbbtYFRu9fdjHgaeyHd5k0aJKr:WIpinKCOFURu9Fk1yH/k0
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/992-48-0x0000000001140000-0x0000000001156000-memory.dmp

Download

memory/1992-25-0x000000001B1A0000-0x000000001B482000-memory.dmp

Download

memory/1992-26-0x0000000002370000-0x0000000002378000-memory.dmp

Download

memory/2068-43-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

Download

memory/2068-13-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

Download

memory/2068-7-0x0000000001110000-0x0000000001126000-memory.dmp

Download

memory/2068-38-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

Download

memory/2068-44-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

Download

memory/2392-0-0x000007FEF5F03000-0x000007FEF5F04000-memory.dmp

Download

memory/2392-1-0x0000000001050000-0x0000000001196000-memory.dmp

Download

memory/2952-18-0x000000001B0D0000-0x000000001B3B2000-memory.dmp

Download

memory/2952-19-0x00000000025A0000-0x00000000025A8000-memory.dmp

Download

memory/2992-45-0x0000000140000000-0x00000001405E8000-memory.dmp

Download

memory/2992-46-0x0000000140000000-0x00000001405E8000-memory.dmp

Download

memory/3000-42-0x0000000000CE0000-0x0000000000CF6000-memory.dmp

Download