xworm | 48d709a89f1ede2666185789ae0747f90139d7d46687d05cb6d17e45a3fea965

General

Target

XClient.exe
Size

69KB
MD5

7fa99ccbea8ecaf80ed87ebdb44c17dd
SHA1

e2f29018810fbf56a5e475a187d749f3adbbc0a7
SHA256

48d709a89f1ede2666185789ae0747f90139d7d46687d05cb6d17e45a3fea965
SHA512

39165c4fc25403823d124e43022ca8fa78e643204885024ff9c0f96b9d3f021ec44287f5080b7115e68e8c254627660512d2430e4e68bbe6b778607e7f4a9d83
SSDEEP

1536:yc52LJ8cdIA01NxTZ6BYjmzJibJ+bQzAxAS91mb6uLO1X5g:d5WJpb0NTABXzk+bQzE+LO1Xu

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

brands-colors.gl.at.ply.gg:28379

Attributes

Install_directory
%ProgramData%
install_file
svchost.exe

Signatures

Detect Xworm Payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2676-1-0x00000000003E0000-0x00000000003F8000-memory.dmp	family_xworm
behavioral1/memory/2680-6-0x0000000002900000-0x0000000002980000-memory.dmp	family_xworm
behavioral1/files/0x000c00000001202b-30.dat	family_xworm
behavioral1/memory/1740-32-0x0000000000F70000-0x0000000000F88000-memory.dmp	family_xworm
behavioral1/memory/2896-35-0x00000000010C0000-0x00000000010D8000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
2680	powershell.exe
1724	powershell.exe
2944	powershell.exe
1456	powershell.exe

Executes dropped EXE 3 IoCs

Processes:

svchost.exesvchost.exesvchost.exe

pid	Process
1740	svchost.exe
2896	svchost.exe
3012	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

XClient.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\ProgramData\\svchost.exe"	XClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exe

pid	Process
2808	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeXClient.exe

pid	Process
2680	powershell.exe
1724	powershell.exe
2944	powershell.exe
1456	powershell.exe
2676	XClient.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

XClient.exepowershell.exepowershell.exepowershell.exepowershell.exesvchost.exesvchost.exesvchost.exe

description	pid	Process
Token: SeDebugPrivilege	2676	XClient.exe
Token: SeDebugPrivilege	2680	powershell.exe
Token: SeDebugPrivilege	1724	powershell.exe
Token: SeDebugPrivilege	2944	powershell.exe
Token: SeDebugPrivilege	1456	powershell.exe
Token: SeDebugPrivilege	2676	XClient.exe
Token: SeDebugPrivilege	1740	svchost.exe
Token: SeDebugPrivilege	2896	svchost.exe
Token: SeDebugPrivilege	3012	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

XClient.exe

pid	Process
2676	XClient.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

XClient.exetaskeng.exe

description	pid	Process	procid_target
PID 2676 wrote to memory of 2680	2676	XClient.exe	31
PID 2676 wrote to memory of 2680	2676	XClient.exe	31
PID 2676 wrote to memory of 2680	2676	XClient.exe	31
PID 2676 wrote to memory of 1724	2676	XClient.exe	33
PID 2676 wrote to memory of 1724	2676	XClient.exe	33
PID 2676 wrote to memory of 1724	2676	XClient.exe	33
PID 2676 wrote to memory of 2944	2676	XClient.exe	35
PID 2676 wrote to memory of 2944	2676	XClient.exe	35
PID 2676 wrote to memory of 2944	2676	XClient.exe	35
PID 2676 wrote to memory of 1456	2676	XClient.exe	37
PID 2676 wrote to memory of 1456	2676	XClient.exe	37
PID 2676 wrote to memory of 1456	2676	XClient.exe	37
PID 2676 wrote to memory of 2808	2676	XClient.exe	39
PID 2676 wrote to memory of 2808	2676	XClient.exe	39
PID 2676 wrote to memory of 2808	2676	XClient.exe	39
PID 1064 wrote to memory of 1740	1064	taskeng.exe	42
PID 1064 wrote to memory of 1740	1064	taskeng.exe	42
PID 1064 wrote to memory of 1740	1064	taskeng.exe	42
PID 1064 wrote to memory of 2896	1064	taskeng.exe	44
PID 1064 wrote to memory of 2896	1064	taskeng.exe	44
PID 1064 wrote to memory of 2896	1064	taskeng.exe	44
PID 1064 wrote to memory of 3012	1064	taskeng.exe	45
PID 1064 wrote to memory of 3012	1064	taskeng.exe	45
PID 1064 wrote to memory of 3012	1064	taskeng.exe	45

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1456
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\ProgramData\svchost.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2808

C:\Windows\system32\taskeng.exe
taskeng.exe {F192E57D-6360-4C45-8678-D4908A19EB7F} S-1-5-21-1506706701-1246725540-2219210854-1000:MUYDDIIS\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1064
- C:\ProgramData\svchost.exe
  C:\ProgramData\svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1740
- C:\ProgramData\svchost.exe
  C:\ProgramData\svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2896
- C:\ProgramData\svchost.exe
  C:\ProgramData\svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\svchost.exe

Filesize
69KB

MD5
7fa99ccbea8ecaf80ed87ebdb44c17dd

SHA1
e2f29018810fbf56a5e475a187d749f3adbbc0a7

SHA256
48d709a89f1ede2666185789ae0747f90139d7d46687d05cb6d17e45a3fea965

SHA512
39165c4fc25403823d124e43022ca8fa78e643204885024ff9c0f96b9d3f021ec44287f5080b7115e68e8c254627660512d2430e4e68bbe6b778607e7f4a9d83

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
f6fc63cc5be61a01ecdf73045d068bb9

SHA1
fbbce510bee7c92b8ef0c2674fdf25840bf0f339

SHA256
ea6ff467aba08eb3c00d8009ceb6795a166860e5a728c347140abddd6970c130

SHA512
b4099535bf15eaccac7d6ccce305945b8542affe9bb4725ca752b47302b7fc6114bdc39b534bf74220a7934df2c6ac2fafc90cfbfd8a650f3178d4aa1954dc13

Download Submit
memory/1724-15-0x00000000027A0000-0x00000000027A8000-memory.dmp

Filesize
32KB

Download
memory/1724-14-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/1740-32-0x0000000000F70000-0x0000000000F88000-memory.dmp

Filesize
96KB

Download
memory/2676-28-0x000007FEF58B3000-0x000007FEF58B4000-memory.dmp

Filesize
4KB

Download
memory/2676-27-0x0000000000500000-0x0000000000580000-memory.dmp

Filesize
512KB

Download
memory/2676-0-0x000007FEF58B3000-0x000007FEF58B4000-memory.dmp

Filesize
4KB

Download
memory/2676-1-0x00000000003E0000-0x00000000003F8000-memory.dmp

Filesize
96KB

Download
memory/2676-33-0x0000000000500000-0x0000000000580000-memory.dmp

Filesize
512KB

Download
memory/2680-8-0x0000000002AF0000-0x0000000002AF8000-memory.dmp

Filesize
32KB

Download
memory/2680-7-0x000000001B510000-0x000000001B7F2000-memory.dmp

Filesize
2.9MB

Download
memory/2680-6-0x0000000002900000-0x0000000002980000-memory.dmp

Filesize
512KB

Download
memory/2896-35-0x00000000010C0000-0x00000000010D8000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads