xworm | a0df39907655aeb4626b3cec17e3aeaf1e92da815777937fef08f8c29d7c10cd

Analysis

max time kernel
137s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 11:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a0df39907655aeb4626b3cec17e3aeaf1e92da815777937fef08f8c29d7c10cd.exe
Size

36KB
MD5

8302b805bd915c1250b2391d1aa0c359
SHA1

f5ef47e996436541e6d3c2c267f2a4f2056cf495
SHA256

a0df39907655aeb4626b3cec17e3aeaf1e92da815777937fef08f8c29d7c10cd
SHA512

b5ee60b3474bd3b1c6e5be02be952466b94a098f223646b258bec1a5786083924bc6f8388f951d61b226f51119bcf60e6699000936098ad8a93d4e23b160b746
SSDEEP

768:yTAJM/jPWzJzpw9FALFyn9CvIOjhHD2LF:yEsjO+aFU9CvIOjo

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

components-resort.gl.at.ply.gg:9316

Mutex

reVzymUkbxqiZfqc

Attributes

Install_directory
%AppData%
install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1988-1-0x0000000000E50000-0x0000000000E60000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-Defender.lnk	a0df39907655aeb4626b3cec17e3aeaf1e92da815777937fef08f8c29d7c10cd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-Defender.lnk	a0df39907655aeb4626b3cec17e3aeaf1e92da815777937fef08f8c29d7c10cd.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
19	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4500	timeout.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	a0df39907655aeb4626b3cec17e3aeaf1e92da815777937fef08f8c29d7c10cd.exe
Token: SeDebugPrivilege	1988	a0df39907655aeb4626b3cec17e3aeaf1e92da815777937fef08f8c29d7c10cd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 3268	1988	a0df39907655aeb4626b3cec17e3aeaf1e92da815777937fef08f8c29d7c10cd.exe	98
PID 1988 wrote to memory of 3268	1988	a0df39907655aeb4626b3cec17e3aeaf1e92da815777937fef08f8c29d7c10cd.exe	98
PID 3268 wrote to memory of 4500	3268	cmd.exe	100
PID 3268 wrote to memory of 4500	3268	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\a0df39907655aeb4626b3cec17e3aeaf1e92da815777937fef08f8c29d7c10cd.exe
"C:\Users\Admin\AppData\Local\Temp\a0df39907655aeb4626b3cec17e3aeaf1e92da815777937fef08f8c29d7c10cd.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp2788.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2788.tmp.bat

Filesize
216B

MD5
4ec1067c45c073f261af3aa4e8dbffda

SHA1
eda28a327558285befeb731f66962f693d07acc3

SHA256
a6ee42a97e65343a14a1d6a64ec01c084feb5b2fd45a99c8146e160e0e345c32

SHA512
a39dba9c85cd8decb2a071d07442ac17dfb9aefa1b5728788be8aa50abdc4dafa2aad69c529ab4fc0643529442c8b83b405bb17738b493e569f94094dec10b5d

Download Submit
memory/1988-0-0x00007FF9BF913000-0x00007FF9BF915000-memory.dmp

Filesize
8KB

Download
memory/1988-1-0x0000000000E50000-0x0000000000E60000-memory.dmp

Filesize
64KB

Download
memory/1988-2-0x00007FF9BF910000-0x00007FF9C03D1000-memory.dmp

Filesize
10.8MB

Download
memory/1988-6-0x000000001B9C0000-0x000000001B9CC000-memory.dmp

Filesize
48KB

Download
memory/1988-7-0x00007FF9BF913000-0x00007FF9BF915000-memory.dmp

Filesize
8KB

Download
memory/1988-8-0x00007FF9BF910000-0x00007FF9C03D1000-memory.dmp

Filesize
10.8MB

Download
memory/1988-16-0x00007FF9BF910000-0x00007FF9C03D1000-memory.dmp

Filesize
10.8MB

Download