xworm | 1731919d2dc81ad27833aaaf162c923c8c0e9ec12f0517c7db0409b74e9550c6

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 18:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zvgfd-main/Fanta.Live.exe
Size

79KB
MD5

a378eb40a60e9a4fb826d90b919dbc34
SHA1

46921006940cda5096b30e0788a5c8e4bddb9137
SHA256

356643a10605dba3e7497cb2cbc586951d99dcb95e9fa8a64b65a6fe4d874ef6
SHA512

2a73b843c3f8c508ead9e8fb73a2f1231d0f0cdc6a483e48a403f891710b9c94e79fca9be499f857a0a7a8189b056464d0e1d37ddae22704951dab66ab719505
SSDEEP

1536:ynOPvOn3Dxn2xpP+EnGlDRXxWO2jCt+htJ5bGr9VMKO/6IO27Ecdo9JfBFKn:yOPozl2xpsx+hxbGpqKOxOSEcdoTXKn

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

super-nearest.gl.at.ply.gg:17835

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral19/memory/2756-1-0x0000000000870000-0x000000000088A000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2688	powershell.exe
2640	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2688	powershell.exe
2640	powershell.exe
2756	Fanta.Live.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2756	Fanta.Live.exe
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	2640	powershell.exe
Token: SeDebugPrivilege	2756	Fanta.Live.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2756	Fanta.Live.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2688	2756	Fanta.Live.exe	29
PID 2756 wrote to memory of 2688	2756	Fanta.Live.exe	29
PID 2756 wrote to memory of 2688	2756	Fanta.Live.exe	29
PID 2756 wrote to memory of 2640	2756	Fanta.Live.exe	31
PID 2756 wrote to memory of 2640	2756	Fanta.Live.exe	31
PID 2756 wrote to memory of 2640	2756	Fanta.Live.exe	31

C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Fanta.Live.exe
"C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Fanta.Live.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Fanta.Live.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Fanta.Live.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\FEJXQEDRK996UGJ8PL65.temp

Filesize
7KB

MD5
115c472defce54ab8fe2503c3f52b52b

SHA1
4ecbd6b5e6a14a81f7e5b524b3d27171dc80dc7c

SHA256
3f310043809952feac3cfd4d5625078d860107eb505203137b8137637c98153e

SHA512
8643f43b65b5c24d80410b30404a1b212ba0302f9cadfd0d28c975bd723e56b9cf30cd6ffce9588a7774ed87aedb4dce44cc2089ee275639c7df14c404f4c70b

Download Submit
memory/2640-15-0x000000001B7A0000-0x000000001BA82000-memory.dmp

Filesize
2.9MB

Download
memory/2640-16-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/2688-7-0x00000000028C0000-0x0000000002940000-memory.dmp

Filesize
512KB

Download
memory/2688-8-0x000000001B4C0000-0x000000001B7A2000-memory.dmp

Filesize
2.9MB

Download
memory/2688-9-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/2756-0-0x000007FEF6053000-0x000007FEF6054000-memory.dmp

Filesize
4KB

Download
memory/2756-1-0x0000000000870000-0x000000000088A000-memory.dmp

Filesize
104KB

Download
memory/2756-2-0x000007FEF6050000-0x000007FEF6A3C000-memory.dmp

Filesize
9.9MB

Download
memory/2756-17-0x000007FEF6053000-0x000007FEF6054000-memory.dmp

Filesize
4KB

Download
memory/2756-18-0x000007FEF6050000-0x000007FEF6A3C000-memory.dmp

Filesize
9.9MB

Download