xworm | cf7a4925fdb1f1add01d039751d168ecf9fc958efe3b926c14566d207de4b6b4

Analysis

max time kernel
594s
max time network
605s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 15:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Modrinth_Installer.exe
Size

5.6MB
MD5

578b2c56cabfa2d2a29bc7c0184a8e1d
SHA1

11326b4b732c5cdb0edf9541c70d2dea3411ad6f
SHA256

cf7a4925fdb1f1add01d039751d168ecf9fc958efe3b926c14566d207de4b6b4
SHA512

7ef67f3e50ad6bfb49b4fe62c7b44982d9b1620627c6514c535fb7df5c56aceb16a0392d7c9af82016d42a809ea2475eb1c4595bf87cedb3657a73d0fa6b57d8
SSDEEP

98304:AxdENT+6HE4ThcGalSS9d+udj3mYcCqQcgT3XV8tEbETvsDHaLqV710ZZ9rPzrPH:v/HMlS2JxmYcmcg7XGqb6Msq51GPf

Score

10^/10

xworm discovery persistence rat trojan

Malware Config

Extracted

Family

xworm

she-vocal.gl.at.ply.gg:36704

Attributes

Install_directory
%AppData%
install_file
notepad.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0009000000023477-4.dat	family_xworm
behavioral2/memory/4836-13-0x0000000000C10000-0x0000000000C66000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	Modrinth_Installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	Modrinth.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\notepad.lnk	Modrinth.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\notepad.lnk	Modrinth.exe

Executes dropped EXE 11 IoCs

pid	Process
4836	Modrinth.exe
1344	notepad.exe
2384	notepad.exe
1664	notepad.exe
5016	notepad.exe
3372	notepad.exe
4172	notepad.exe
2632	notepad.exe
3268	notepad.exe
1160	notepad.exe
4868	notepad.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\notepad = "C:\\Users\\Admin\\AppData\\Roaming\\notepad.exe"	Modrinth.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
22	228	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
20	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Modrinth_Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings	Modrinth_Installer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4196	schtasks.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	4836	Modrinth.exe
Token: SeShutdownPrivilege	228	msiexec.exe
Token: SeIncreaseQuotaPrivilege	228	msiexec.exe
Token: SeSecurityPrivilege	2152	msiexec.exe
Token: SeCreateTokenPrivilege	228	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	228	msiexec.exe
Token: SeLockMemoryPrivilege	228	msiexec.exe
Token: SeIncreaseQuotaPrivilege	228	msiexec.exe
Token: SeMachineAccountPrivilege	228	msiexec.exe
Token: SeTcbPrivilege	228	msiexec.exe
Token: SeSecurityPrivilege	228	msiexec.exe
Token: SeTakeOwnershipPrivilege	228	msiexec.exe
Token: SeLoadDriverPrivilege	228	msiexec.exe
Token: SeSystemProfilePrivilege	228	msiexec.exe
Token: SeSystemtimePrivilege	228	msiexec.exe
Token: SeProfSingleProcessPrivilege	228	msiexec.exe
Token: SeIncBasePriorityPrivilege	228	msiexec.exe
Token: SeCreatePagefilePrivilege	228	msiexec.exe
Token: SeCreatePermanentPrivilege	228	msiexec.exe
Token: SeBackupPrivilege	228	msiexec.exe
Token: SeRestorePrivilege	228	msiexec.exe
Token: SeShutdownPrivilege	228	msiexec.exe
Token: SeDebugPrivilege	228	msiexec.exe
Token: SeAuditPrivilege	228	msiexec.exe
Token: SeSystemEnvironmentPrivilege	228	msiexec.exe
Token: SeChangeNotifyPrivilege	228	msiexec.exe
Token: SeRemoteShutdownPrivilege	228	msiexec.exe
Token: SeUndockPrivilege	228	msiexec.exe
Token: SeSyncAgentPrivilege	228	msiexec.exe
Token: SeEnableDelegationPrivilege	228	msiexec.exe
Token: SeManageVolumePrivilege	228	msiexec.exe
Token: SeImpersonatePrivilege	228	msiexec.exe
Token: SeCreateGlobalPrivilege	228	msiexec.exe
Token: SeDebugPrivilege	4836	Modrinth.exe
Token: SeDebugPrivilege	1344	notepad.exe
Token: SeDebugPrivilege	2384	notepad.exe
Token: SeDebugPrivilege	1664	notepad.exe
Token: SeDebugPrivilege	5016	notepad.exe
Token: SeDebugPrivilege	3372	notepad.exe
Token: SeDebugPrivilege	4172	notepad.exe
Token: SeDebugPrivilege	2632	notepad.exe
Token: SeDebugPrivilege	3268	notepad.exe
Token: SeDebugPrivilege	1160	notepad.exe
Token: SeDebugPrivilege	4868	notepad.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
228	msiexec.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 4836	3600	Modrinth_Installer.exe	88
PID 3600 wrote to memory of 4836	3600	Modrinth_Installer.exe	88
PID 3600 wrote to memory of 228	3600	Modrinth_Installer.exe	89
PID 3600 wrote to memory of 228	3600	Modrinth_Installer.exe	89
PID 3600 wrote to memory of 228	3600	Modrinth_Installer.exe	89
PID 4836 wrote to memory of 4196	4836	Modrinth.exe	93
PID 4836 wrote to memory of 4196	4836	Modrinth.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Modrinth_Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Modrinth_Installer.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Users\Admin\AppData\Local\Temp\Modrinth.exe
  "C:\Users\Admin\AppData\Local\Temp\Modrinth.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "notepad" /tr "C:\Users\Admin\AppData\Roaming\notepad.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4196
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Modrinth App_0.7.1_x64_en-US.msi"
  2⤵
  - Blocklisted process makes network request
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:228

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2152

C:\Users\Admin\AppData\Roaming\notepad.exe
C:\Users\Admin\AppData\Roaming\notepad.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1344

C:\Users\Admin\AppData\Roaming\notepad.exe
C:\Users\Admin\AppData\Roaming\notepad.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2384

C:\Users\Admin\AppData\Roaming\notepad.exe
C:\Users\Admin\AppData\Roaming\notepad.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1664

C:\Users\Admin\AppData\Roaming\notepad.exe
C:\Users\Admin\AppData\Roaming\notepad.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5016

C:\Users\Admin\AppData\Roaming\notepad.exe
C:\Users\Admin\AppData\Roaming\notepad.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3372

C:\Users\Admin\AppData\Roaming\notepad.exe
C:\Users\Admin\AppData\Roaming\notepad.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4172

C:\Users\Admin\AppData\Roaming\notepad.exe
C:\Users\Admin\AppData\Roaming\notepad.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2632

C:\Users\Admin\AppData\Roaming\notepad.exe
C:\Users\Admin\AppData\Roaming\notepad.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3268

C:\Users\Admin\AppData\Roaming\notepad.exe
C:\Users\Admin\AppData\Roaming\notepad.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1160

C:\Users\Admin\AppData\Roaming\notepad.exe
C:\Users\Admin\AppData\Roaming\notepad.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\notepad.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Modrinth App_0.7.1_x64_en-US.msi

Filesize
5.0MB

MD5
5003486a784143bc96c3577172bbb44a

SHA1
9a960998807126041fae5b4fe9488d7ff3c5ca42

SHA256
b1ac36000cee14b9c36aea4cef7f53ed2e7c18c9534b4ff66f07da11e8c07b59

SHA512
3fd871414cffe35ae649dbb02935eddcad75ee094f2d61f2cef48827dfb852ff3b8e4211f913bf65e4619b2a4989a2807d876a920a105735ac3e59362802ee19

Download Submit
C:\Users\Admin\AppData\Local\Temp\Modrinth.exe

Filesize
316KB

MD5
6f56f305614cbad9e5737acbee0f8894

SHA1
8feb8eb68fd2a0b8b502032073277961ec5d9ab9

SHA256
7389aaa07392f6533dc7a4b1f0377ab9b694bb5c08a45f7b871062e7f9f0bdff

SHA512
bcfa430e336735785d988c3276d0524a0c66f629a8b26a39d6b4f93607f6f435f7ade02f68f963cf4bcbc6a42c63ea99ad6da8020f41defab242bd197121a26c

Download Submit
memory/3600-18-0x0000000000400000-0x00000000009A7000-memory.dmp

Filesize
5.7MB

Download
memory/4836-12-0x00007FFAD17F3000-0x00007FFAD17F5000-memory.dmp

Filesize
8KB

Download
memory/4836-13-0x0000000000C10000-0x0000000000C66000-memory.dmp

Filesize
344KB

Download
memory/4836-20-0x00007FFAD17F0000-0x00007FFAD22B1000-memory.dmp

Filesize
10.8MB

Download
memory/4836-34-0x00007FFAD17F3000-0x00007FFAD17F5000-memory.dmp

Filesize
8KB

Download
memory/4836-35-0x00007FFAD17F0000-0x00007FFAD22B1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads