xworm | 774529f26b02e6ac05bafff286f930882b7c8f10b73222b040f7d47430d2a888

General

Target

774529f26b02e6ac05bafff286f930882b7c8f10b73222b040f7d47430d2a888.exe
Size

50KB
MD5

20e2bdf68c3b6acfda5735422b64cbea
SHA1

181aa68712a5e2f06f136e065291f083c35f32dc
SHA256

774529f26b02e6ac05bafff286f930882b7c8f10b73222b040f7d47430d2a888
SHA512

188c77234438a34673cc2b2164c180ff0b3d9f35ff2b17c704b36acb655d47a2a034632a59a3ed4945daae692316774c8a6fd53e80ffc53217c8045f7bc88b36
SSDEEP

1536:Tf05a/CTjo89wFc9UR68OMuodS1EAd8IIm:Tf05a/CTD9wFc9U3OMhgEA6IIm

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

103.216.158.119:7000

Mutex

gjV5QKceVphN17zl

Attributes

Install_directory
%ProgramData%
install_file
VLC_media.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2628-1-0x0000000000690000-0x00000000006A2000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

4340 powershell.exe
4128 powershell.exe
3212 powershell.exe
4592 powershell.exe

pid	process
4340	powershell.exe
4128	powershell.exe
3212	powershell.exe
4592	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

774529f26b02e6ac05bafff286f930882b7c8f10b73222b040f7d47430d2a888.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	774529f26b02e6ac05bafff286f930882b7c8f10b73222b040f7d47430d2a888.exe

Drops startup file 2 IoCs

Processes:

774529f26b02e6ac05bafff286f930882b7c8f10b73222b040f7d47430d2a888.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VLC_media.lnk	774529f26b02e6ac05bafff286f930882b7c8f10b73222b040f7d47430d2a888.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VLC_media.lnk	774529f26b02e6ac05bafff286f930882b7c8f10b73222b040f7d47430d2a888.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

14 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
14	ip-api.com

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe774529f26b02e6ac05bafff286f930882b7c8f10b73222b040f7d47430d2a888.exe

pid	process
4592	powershell.exe
4592	powershell.exe
4340	powershell.exe
4340	powershell.exe
4128	powershell.exe
4128	powershell.exe
3212	powershell.exe
3212	powershell.exe
2628	774529f26b02e6ac05bafff286f930882b7c8f10b73222b040f7d47430d2a888.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

774529f26b02e6ac05bafff286f930882b7c8f10b73222b040f7d47430d2a888.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2628	774529f26b02e6ac05bafff286f930882b7c8f10b73222b040f7d47430d2a888.exe
Token: SeDebugPrivilege	4592	powershell.exe
Token: SeDebugPrivilege	4340	powershell.exe
Token: SeDebugPrivilege	4128	powershell.exe
Token: SeDebugPrivilege	3212	powershell.exe
Token: SeDebugPrivilege	2628	774529f26b02e6ac05bafff286f930882b7c8f10b73222b040f7d47430d2a888.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

774529f26b02e6ac05bafff286f930882b7c8f10b73222b040f7d47430d2a888.exe

pid process

2628 774529f26b02e6ac05bafff286f930882b7c8f10b73222b040f7d47430d2a888.exe

pid	process
2628	774529f26b02e6ac05bafff286f930882b7c8f10b73222b040f7d47430d2a888.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

774529f26b02e6ac05bafff286f930882b7c8f10b73222b040f7d47430d2a888.exe

description	pid	process	target process
PID 2628 wrote to memory of 4592	2628	774529f26b02e6ac05bafff286f930882b7c8f10b73222b040f7d47430d2a888.exe	powershell.exe
PID 2628 wrote to memory of 4592	2628	774529f26b02e6ac05bafff286f930882b7c8f10b73222b040f7d47430d2a888.exe	powershell.exe
PID 2628 wrote to memory of 4340	2628	774529f26b02e6ac05bafff286f930882b7c8f10b73222b040f7d47430d2a888.exe	powershell.exe
PID 2628 wrote to memory of 4340	2628	774529f26b02e6ac05bafff286f930882b7c8f10b73222b040f7d47430d2a888.exe	powershell.exe
PID 2628 wrote to memory of 4128	2628	774529f26b02e6ac05bafff286f930882b7c8f10b73222b040f7d47430d2a888.exe	powershell.exe
PID 2628 wrote to memory of 4128	2628	774529f26b02e6ac05bafff286f930882b7c8f10b73222b040f7d47430d2a888.exe	powershell.exe
PID 2628 wrote to memory of 3212	2628	774529f26b02e6ac05bafff286f930882b7c8f10b73222b040f7d47430d2a888.exe	powershell.exe
PID 2628 wrote to memory of 3212	2628	774529f26b02e6ac05bafff286f930882b7c8f10b73222b040f7d47430d2a888.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\774529f26b02e6ac05bafff286f930882b7c8f10b73222b040f7d47430d2a888.exe
"C:\Users\Admin\AppData\Local\Temp\774529f26b02e6ac05bafff286f930882b7c8f10b73222b040f7d47430d2a888.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\774529f26b02e6ac05bafff286f930882b7c8f10b73222b040f7d47430d2a888.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '774529f26b02e6ac05bafff286f930882b7c8f10b73222b040f7d47430d2a888.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\VLC_media.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'VLC_media.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6c47b3f4e68eebd47e9332eebfd2dd4e

SHA1
67f0b143336d7db7b281ed3de5e877fa87261834

SHA256
8c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c

SHA512
0acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
65a68df1062af34622552c4f644a5708

SHA1
6f6ecf7b4b635abb0b132d95dac2759dc14b50af

SHA256
718dc2f5f4a6dbb7fab7f3db05bd7f602fb16526caae7084ab46c3ab4e7bad35

SHA512
4e460eb566032942547b58411222dd26ae300a95f83cf5ae6df58ebd28594341123611b348bd4031a33bc7f38307d5cb8fb677bba8c896919e3eee677a104d4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9a2c763c5ff40e18e49ad63c7c3b0088

SHA1
4b289ea34755323fa869da6ad6480d8d12385a36

SHA256
517807921c55bd16cd8a8bfae3d5dc19444c66f836b66acd5593e3080acbaf8e

SHA512
3af01926bc7de92076067d158d7250b206d396b3282ee0db43639d04d91bd9ff763acbce12c7822914824984a3c5fdd1b8dbf1ad2ee88233d47f0f808b746bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l2usffyx.iz2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2628-1-0x0000000000690000-0x00000000006A2000-memory.dmp

Filesize
72KB

Download
memory/2628-2-0x00007FFC00D90000-0x00007FFC01851000-memory.dmp

Filesize
10.8MB

Download
memory/2628-0-0x00007FFC00D93000-0x00007FFC00D95000-memory.dmp

Filesize
8KB

Download
memory/2628-57-0x00007FFC00D90000-0x00007FFC01851000-memory.dmp

Filesize
10.8MB

Download
memory/4592-3-0x0000020BB5E50000-0x0000020BB5E72000-memory.dmp

Filesize
136KB

Download
memory/4592-18-0x00007FFC00D90000-0x00007FFC01851000-memory.dmp

Filesize
10.8MB

Download
memory/4592-15-0x00007FFC00D90000-0x00007FFC01851000-memory.dmp

Filesize
10.8MB

Download
memory/4592-14-0x00007FFC00D90000-0x00007FFC01851000-memory.dmp

Filesize
10.8MB

Download
memory/4592-12-0x00007FFC00D90000-0x00007FFC01851000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads