General

  • Target

    Background.zip

  • Size

    42.7MB

  • Sample

    240802-21cxmsyenf

  • MD5

    e953ce51e22c8c7f91a5c39070e035e3

  • SHA1

    36b39e46b4080e547729e9efe61cfdf6dda1da47

  • SHA256

    a6e8143988cc3cec60fa43802be8a1e4e7ca5d0b5240b4897091c1a857d71144

  • SHA512

    cd4b3461d88c6c534a5d18e45a0c15321c534f0c77cb43c2b1019af8945f0d6cfd8c76da35109f6b60a1f80c465559ff84ddc138e96d5585293d18403adba22d

  • SSDEEP

    786432:pCxgXxrCT0kw0E4w+p+xU8BafhLn9+2lxpFMXLAsjm03JKnb9by8U0/4lwtdA8Z3:xXxrCTvbExU8IrNhMXLe2KnJQ0/4lsbp

Malware Config

Extracted

Family

xworm

C2

31.167.24.129:7000

154.61.71.50:7000

2.90.87.156:7000

86.96.100.98:7000

Attributes
  • Install_directory

    %Temp%

  • install_file

    USB.exe

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:7000

Mutex

JYj1EIwWwj45bGVr

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

aes.plain

Targets

    • Target

      Background.zip

    • Size

      42.7MB

    • MD5

      e953ce51e22c8c7f91a5c39070e035e3

    • SHA1

      36b39e46b4080e547729e9efe61cfdf6dda1da47

    • SHA256

      a6e8143988cc3cec60fa43802be8a1e4e7ca5d0b5240b4897091c1a857d71144

    • SHA512

      cd4b3461d88c6c534a5d18e45a0c15321c534f0c77cb43c2b1019af8945f0d6cfd8c76da35109f6b60a1f80c465559ff84ddc138e96d5585293d18403adba22d

    • SSDEEP

      786432:pCxgXxrCT0kw0E4w+p+xU8BafhLn9+2lxpFMXLAsjm03JKnb9by8U0/4lwtdA8Z3:xXxrCTvbExU8IrNhMXLe2KnJQ0/4lsbp

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Download via BitsAdmin

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks