xworm | baa8ace81d5e51f20fea99bf6b8de26c594a2011b670883304e085e5a9847eb2

Analysis

max time kernel
129s
max time network
150s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
01-08-2024 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XClient.exe
Size

80KB
MD5

bfa950b37b6a4f8de71af861e677a8b4
SHA1

2ee40bfbf2964d92c82256e5924169295dfdd225
SHA256

07f94f8f6061ba95899914496edc5854aa810de56797d9004875276d60e21ade
SHA512

235b514fac01b24edaef3aeb4209676789b6ba9264a8798cb7ae48c26d2455cdd8f254e92bbba688535acb69fd77b3c0a0a549cf97ece84c235cc74f72234e1a
SSDEEP

1536:EI5NuEGJkEtydWqZQSp1eS+b59gxzhfxdl/5m6qeo//3Oy/4IK4Dax5:Eg1GhtktQGAS+b59cJ4eA/OlINDab

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

full-self.gl.at.ply.gg:45212

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1300-1-0x00000000009F0000-0x0000000000A0A000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5032	powershell.exe
2572	powershell.exe
2876	powershell.exe
3532	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	XClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5032	powershell.exe
5032	powershell.exe
5032	powershell.exe
2572	powershell.exe
2572	powershell.exe
2572	powershell.exe
2876	powershell.exe
2876	powershell.exe
2876	powershell.exe
3532	powershell.exe
3532	powershell.exe
3532	powershell.exe
1300	XClient.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1300	XClient.exe
Token: SeDebugPrivilege	5032	powershell.exe
Token: SeIncreaseQuotaPrivilege	5032	powershell.exe
Token: SeSecurityPrivilege	5032	powershell.exe
Token: SeTakeOwnershipPrivilege	5032	powershell.exe
Token: SeLoadDriverPrivilege	5032	powershell.exe
Token: SeSystemProfilePrivilege	5032	powershell.exe
Token: SeSystemtimePrivilege	5032	powershell.exe
Token: SeProfSingleProcessPrivilege	5032	powershell.exe
Token: SeIncBasePriorityPrivilege	5032	powershell.exe
Token: SeCreatePagefilePrivilege	5032	powershell.exe
Token: SeBackupPrivilege	5032	powershell.exe
Token: SeRestorePrivilege	5032	powershell.exe
Token: SeShutdownPrivilege	5032	powershell.exe
Token: SeDebugPrivilege	5032	powershell.exe
Token: SeSystemEnvironmentPrivilege	5032	powershell.exe
Token: SeRemoteShutdownPrivilege	5032	powershell.exe
Token: SeUndockPrivilege	5032	powershell.exe
Token: SeManageVolumePrivilege	5032	powershell.exe
Token: 33	5032	powershell.exe
Token: 34	5032	powershell.exe
Token: 35	5032	powershell.exe
Token: 36	5032	powershell.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeIncreaseQuotaPrivilege	2572	powershell.exe
Token: SeSecurityPrivilege	2572	powershell.exe
Token: SeTakeOwnershipPrivilege	2572	powershell.exe
Token: SeLoadDriverPrivilege	2572	powershell.exe
Token: SeSystemProfilePrivilege	2572	powershell.exe
Token: SeSystemtimePrivilege	2572	powershell.exe
Token: SeProfSingleProcessPrivilege	2572	powershell.exe
Token: SeIncBasePriorityPrivilege	2572	powershell.exe
Token: SeCreatePagefilePrivilege	2572	powershell.exe
Token: SeBackupPrivilege	2572	powershell.exe
Token: SeRestorePrivilege	2572	powershell.exe
Token: SeShutdownPrivilege	2572	powershell.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeSystemEnvironmentPrivilege	2572	powershell.exe
Token: SeRemoteShutdownPrivilege	2572	powershell.exe
Token: SeUndockPrivilege	2572	powershell.exe
Token: SeManageVolumePrivilege	2572	powershell.exe
Token: 33	2572	powershell.exe
Token: 34	2572	powershell.exe
Token: 35	2572	powershell.exe
Token: 36	2572	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeIncreaseQuotaPrivilege	2876	powershell.exe
Token: SeSecurityPrivilege	2876	powershell.exe
Token: SeTakeOwnershipPrivilege	2876	powershell.exe
Token: SeLoadDriverPrivilege	2876	powershell.exe
Token: SeSystemProfilePrivilege	2876	powershell.exe
Token: SeSystemtimePrivilege	2876	powershell.exe
Token: SeProfSingleProcessPrivilege	2876	powershell.exe
Token: SeIncBasePriorityPrivilege	2876	powershell.exe
Token: SeCreatePagefilePrivilege	2876	powershell.exe
Token: SeBackupPrivilege	2876	powershell.exe
Token: SeRestorePrivilege	2876	powershell.exe
Token: SeShutdownPrivilege	2876	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeSystemEnvironmentPrivilege	2876	powershell.exe
Token: SeRemoteShutdownPrivilege	2876	powershell.exe
Token: SeUndockPrivilege	2876	powershell.exe
Token: SeManageVolumePrivilege	2876	powershell.exe
Token: 33	2876	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1300	XClient.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 5032	1300	XClient.exe	70
PID 1300 wrote to memory of 5032	1300	XClient.exe	70
PID 1300 wrote to memory of 2572	1300	XClient.exe	73
PID 1300 wrote to memory of 2572	1300	XClient.exe	73
PID 1300 wrote to memory of 2876	1300	XClient.exe	75
PID 1300 wrote to memory of 2876	1300	XClient.exe	75
PID 1300 wrote to memory of 3532	1300	XClient.exe	77
PID 1300 wrote to memory of 3532	1300	XClient.exe	77

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
aed1e17e0409b64c7c895d8908c98113

SHA1
4108607626d04ca2fb335ba6e39277f874a0d264

SHA256
b108686fc683d7d9c13973b4b28af8be60a76dc5f89aceceb277746180ecd729

SHA512
328a9ed50896921d49604b91e876d400e7695e32a1e471da9d749f12299bfd39a7aaa07f4ff0bb03f2c35d085991a26cc556965e2cead3b26897193695b66be4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
60e6b68384472ecf58c4e80ecefabb96

SHA1
cb614a0d1c493423339f9ea86ca00a62ea4930a7

SHA256
b1a37c5b0df36b1b6df57353303c15f774ad1efbe609258d823d2c76a3da9e50

SHA512
0365aa1b9c6b1fc9e75a00d028fadcb5463e0f61b3d73345358d5bc48146ad7c089cab064ee45fd603878f1dc2828ba4ddc53147c6131dada8b13e47532b6cbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ced7737e8b0275e482bacdad60fae1c0

SHA1
348631a53ef6ea23c815ebb21dd33d2458ce7c7d

SHA256
fbf4b4627e45ef353734be6bca09475a0abe81d3883a28d18508775b23aa2885

SHA512
3256fb11cfef124f1dc1f4dcd98646c5247e447acb99b1c577abbba74ed3456d3b24f62ce48338d0d0b0dcf459040cd149081dbf387a18ee643291d745fa052f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x1gmggtg.a5i.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
memory/1300-1-0x00000000009F0000-0x0000000000A0A000-memory.dmp

Filesize
104KB

Download
memory/1300-185-0x00007FF98D080000-0x00007FF98DA6C000-memory.dmp

Filesize
9.9MB

Download
memory/1300-184-0x00007FF98D080000-0x00007FF98DA6C000-memory.dmp

Filesize
9.9MB

Download
memory/1300-0-0x00007FF98D083000-0x00007FF98D084000-memory.dmp

Filesize
4KB

Download
memory/5032-10-0x000001CEBE4B0000-0x000001CEBE526000-memory.dmp

Filesize
472KB

Download
memory/5032-51-0x00007FF98D080000-0x00007FF98DA6C000-memory.dmp

Filesize
9.9MB

Download
memory/5032-52-0x00007FF98D080000-0x00007FF98DA6C000-memory.dmp

Filesize
9.9MB

Download
memory/5032-25-0x00007FF98D080000-0x00007FF98DA6C000-memory.dmp

Filesize
9.9MB

Download
memory/5032-20-0x00007FF98D080000-0x00007FF98DA6C000-memory.dmp

Filesize
9.9MB

Download
memory/5032-11-0x00007FF98D080000-0x00007FF98DA6C000-memory.dmp

Filesize
9.9MB

Download
memory/5032-9-0x00007FF98D080000-0x00007FF98DA6C000-memory.dmp

Filesize
9.9MB

Download
memory/5032-6-0x000001CEA5D90000-0x000001CEA5DB2000-memory.dmp

Filesize
136KB

Download