Malware Analysis Report

2024-11-16 13:30

Sample ID 240621-nl2essxgmd
Target scvhost.exe
SHA256 924d8102157fd6dbcda4cac2b035be62d8aeeb3e3d8d5bea167989a33d0141fd
Tags
xworm execution rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

924d8102157fd6dbcda4cac2b035be62d8aeeb3e3d8d5bea167989a33d0141fd

Threat Level: Known bad

The file scvhost.exe was found to be: Known bad.

Malicious Activity Summary

xworm execution rat trojan

Detect Xworm Payload

Xworm family

Xworm

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Checks computer location settings

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: AddClipboardFormatListener

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-21 11:29

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm family

xworm

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-21 11:29

Reported

2024-06-21 21:15

Platform

win7-20240611-en

Max time kernel

65s

Max time network

61s

Command Line

"C:\Users\Admin\AppData\Local\Temp\scvhost.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\scvhost.exe N/A

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\scvhost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\scvhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\scvhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\scvhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1252 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\scvhost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1252 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\scvhost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1252 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\scvhost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1252 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\scvhost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1252 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\scvhost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1252 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\scvhost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1252 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\scvhost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1252 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\scvhost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1252 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\scvhost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1252 wrote to memory of 264 N/A C:\Users\Admin\AppData\Local\Temp\scvhost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1252 wrote to memory of 264 N/A C:\Users\Admin\AppData\Local\Temp\scvhost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1252 wrote to memory of 264 N/A C:\Users\Admin\AppData\Local\Temp\scvhost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1252 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\scvhost.exe C:\Windows\System32\schtasks.exe
PID 1252 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\scvhost.exe C:\Windows\System32\schtasks.exe
PID 1252 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\scvhost.exe C:\Windows\System32\schtasks.exe
PID 308 wrote to memory of 1584 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\scvhost.exe
PID 308 wrote to memory of 1584 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\scvhost.exe
PID 308 wrote to memory of 1584 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\scvhost.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\scvhost.exe

"C:\Users\Admin\AppData\Local\Temp\scvhost.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\scvhost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'scvhost.exe'

C:\Windows\explorer.exe

"C:\Windows\explorer.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\scvhost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'scvhost.exe'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "scvhost" /tr "C:\Users\Admin\AppData\Roaming\scvhost.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {102AA688-8D4D-4E37-A2B5-F1A3961AB618} S-1-5-21-39690363-730359138-1046745555-1000:EILATWEW\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\scvhost.exe

C:\Users\Admin\AppData\Roaming\scvhost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 gift-scientists.gl.at.ply.gg udp
US 147.185.221.20:20443 gift-scientists.gl.at.ply.gg tcp
US 147.185.221.20:20443 gift-scientists.gl.at.ply.gg tcp

Files

memory/1252-0-0x000007FEF6023000-0x000007FEF6024000-memory.dmp

memory/1252-1-0x00000000003B0000-0x00000000003C6000-memory.dmp

memory/2296-6-0x0000000002650000-0x00000000026D0000-memory.dmp

memory/2296-7-0x000000001B390000-0x000000001B672000-memory.dmp

memory/2296-8-0x0000000001F20000-0x0000000001F28000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 dbc20fee0125584009d8709f620b7764
SHA1 c376d243dd954918c46c8119c59ad1ecc4df9da2
SHA256 235ef57319d903c4d01f0ee5a1af4779e1306d35b4a8036bad093d0256e7f8d1
SHA512 2174cc258f0e2cc935d34978d756948b8c0b48bb38fb6063adc4c42d66b35e83666ad21e4d77e739b93d9b5bb58d794b5449f36e46da0b84cb2bcb4a7214102a

memory/2608-14-0x000000001B380000-0x000000001B662000-memory.dmp

memory/2608-15-0x0000000001F40000-0x0000000001F48000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1252-28-0x000000001B390000-0x000000001B410000-memory.dmp

memory/1252-29-0x000007FEF6023000-0x000007FEF6024000-memory.dmp

memory/1252-30-0x000000001B390000-0x000000001B410000-memory.dmp

C:\Users\Admin\AppData\Roaming\scvhost.exe

MD5 409c4205d1119c67e3ed65c16f9b71c7
SHA1 2dd6c500f1bc16e59764cd1ac13642463efa52e7
SHA256 924d8102157fd6dbcda4cac2b035be62d8aeeb3e3d8d5bea167989a33d0141fd
SHA512 1de55f5dd34b546078130cb5619295113200d7fc254ef32573db256ece2ebc89181ff0cb92900617728f04a11d688d9b4bbd32b3152d1a66c9d93a206d1d135d

memory/1584-34-0x0000000000920000-0x0000000000936000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-21 11:29

Reported

2024-06-21 21:16

Platform

win10v2004-20240226-en

Max time kernel

143s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\scvhost.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\scvhost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\scvhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\scvhost.exe N/A

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\scvhost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\scvhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\scvhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\scvhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\scvhost.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\scvhost.exe

"C:\Users\Admin\AppData\Local\Temp\scvhost.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\scvhost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'scvhost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\scvhost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'scvhost.exe'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "scvhost" /tr "C:\Users\Admin\AppData\Roaming\scvhost.exe"

C:\Users\Admin\AppData\Roaming\scvhost.exe

C:\Users\Admin\AppData\Roaming\scvhost.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1328 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8

C:\Users\Admin\AppData\Roaming\scvhost.exe

C:\Users\Admin\AppData\Roaming\scvhost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
GB 142.250.200.42:443 tcp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 gift-scientists.gl.at.ply.gg udp
US 147.185.221.20:20443 gift-scientists.gl.at.ply.gg tcp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 147.185.221.20:20443 gift-scientists.gl.at.ply.gg tcp
US 8.8.8.8:53 101.58.20.217.in-addr.arpa udp
US 147.185.221.20:20443 gift-scientists.gl.at.ply.gg tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 147.185.221.20:20443 gift-scientists.gl.at.ply.gg tcp
US 147.185.221.20:20443 gift-scientists.gl.at.ply.gg tcp
US 8.8.8.8:53 25.73.42.20.in-addr.arpa udp

Files

memory/3272-0-0x00007FFA36593000-0x00007FFA36595000-memory.dmp

memory/3272-1-0x0000000000AA0000-0x0000000000AB6000-memory.dmp

memory/4476-2-0x0000026F981A0000-0x0000026F981C2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_31opntaf.qx5.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4476-12-0x00007FFA36590000-0x00007FFA37051000-memory.dmp

memory/4476-13-0x00007FFA36590000-0x00007FFA37051000-memory.dmp

memory/4476-14-0x00007FFA36590000-0x00007FFA37051000-memory.dmp

memory/4476-15-0x00007FFA36590000-0x00007FFA37051000-memory.dmp

memory/4476-16-0x00007FFA36590000-0x00007FFA37051000-memory.dmp

memory/4476-19-0x00007FFA36590000-0x00007FFA37051000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 62623d22bd9e037191765d5083ce16a3
SHA1 4a07da6872672f715a4780513d95ed8ddeefd259
SHA256 95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA512 9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 205f6010c033eefc37d63d8ce846bce4
SHA1 417b1aabb447765a2aa149529a1f4f52ded194ea
SHA256 993dbee9fb487dbdff56c09a1df360ea68b583bd8b28b2c315ec9d92639f3697
SHA512 c6bbd60c82ffbc3297d1d355ab3c6692de97da0b3bdd60ea4aacec6d27d360341cefa11a4411d7b8877d54d1177b48f4dc003e2a391031cc1a304b177689bfaf

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 f5ea6e485a296269f874f3d12709ce50
SHA1 c73e5adec8ceef00e49e0f51d382b990fc5b4d4c
SHA256 980d5cc1b33f9995ce40b593bac646373b613070e5ca6da2c297c5fb8c1f28c3
SHA512 09e3083c712ae875d1dae3d4c903e96e6f5e97f5a15d4301319d3f6f63b2e704ce1b728704fd4ada7f0c26b782b05b551f961db8775f7527b1b1b224e7478659

memory/3272-55-0x00007FFA36590000-0x00007FFA37051000-memory.dmp

memory/3272-56-0x00007FFA36593000-0x00007FFA36595000-memory.dmp

C:\Users\Admin\AppData\Roaming\scvhost.exe

MD5 409c4205d1119c67e3ed65c16f9b71c7
SHA1 2dd6c500f1bc16e59764cd1ac13642463efa52e7
SHA256 924d8102157fd6dbcda4cac2b035be62d8aeeb3e3d8d5bea167989a33d0141fd
SHA512 1de55f5dd34b546078130cb5619295113200d7fc254ef32573db256ece2ebc89181ff0cb92900617728f04a11d688d9b4bbd32b3152d1a66c9d93a206d1d135d

memory/3272-60-0x00007FFA36590000-0x00007FFA37051000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\scvhost.exe.log

MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1