xworm | ddef68a4504b078ddd6f8c5f665898546eb019e2f134551f5b24909f51d668ec

Analysis

max time kernel
119s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/09/2024, 02:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

System.exe
Size

67KB
MD5

5ee1967cc9cde8045b3c8f3a37f685f6
SHA1

62429cb9fbbe082a579c6a908ec4e317cf6a3291
SHA256

ddef68a4504b078ddd6f8c5f665898546eb019e2f134551f5b24909f51d668ec
SHA512

386862a68a3c32d00f2b6fcc8361ad7379dada70b4f28d4ff8077d569b078574a1bc23b33755f9fc1960e69e6efb2182663f8120075e97a0012e1eacb186d014
SSDEEP

1536:tRIUpAK1jniTJUnvPksl9jhK+bH51lT3RmAOvwX8RT:thpAK1jnzv/BK+bH5bT31OvwMt

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

newstartagain.servequake.com:7001

newstartagain50.duckdns.org:7001

Attributes

Install_directory
%AppData%
install_file
USB.exe
telegram
https://api.telegram.org/bot7114416350:AAF9PJoo6_MYxNu2qBazQWSWsWE1Jb_-yh8/sendMessage?chat_id=6653386349

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2372-1-0x0000000000FC0000-0x0000000000FD8000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Users\\Admin\\AppData\\Roaming\\System"	System.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2372	System.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2372	System.exe
Token: SeDebugPrivilege	2372	System.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2372	System.exe

C:\Users\Admin\AppData\Local\Temp\System.exe
"C:\Users\Admin\AppData\Local\Temp\System.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2372-0-0x000007FEF5E53000-0x000007FEF5E54000-memory.dmp

Filesize
4KB

Download
memory/2372-1-0x0000000000FC0000-0x0000000000FD8000-memory.dmp

Filesize
96KB

Download
memory/2372-3-0x000007FEF5E50000-0x000007FEF683C000-memory.dmp

Filesize
9.9MB

Download
memory/2372-4-0x000007FEF5E53000-0x000007FEF5E54000-memory.dmp

Filesize
4KB

Download
memory/2372-5-0x000007FEF5E50000-0x000007FEF683C000-memory.dmp

Filesize
9.9MB

Download