xworm | 222f76224b428d25c8a16437f9d05309ea160816439f25dd5e5003b07ef294a6

General

Target

222f76224b428d25c8a16437f9d05309ea160816439f25dd5e5003b07ef294a6.exe
Size

205KB
MD5

f66d550297b5c67560fcdfef40b9bf5e
SHA1

9ea877d3063ed6f9f381b74e0fc71b9e72b52929
SHA256

222f76224b428d25c8a16437f9d05309ea160816439f25dd5e5003b07ef294a6
SHA512

8247e3a890163c6fddec7dc8bfb420c51cfa6aa5863203f733ad34b611f598c92d6e9405af64ade3fe8149dca55c1504071677b7dbd3c5b57f19a61f43f0ab0d
SSDEEP

3072:ff05a/CTR9hFc9UxOMh8SKfbzxcwg7es6/Vsb8VKTup49oJMfF/H9N3Ky9NzLnF:WR9Hc9wUhcX7elbKTuq9bfF/H9d9n

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

147.50.240.203:7000

Mutex

X0ZQBFW2mJiaVxWi

Attributes

Install_directory
%ProgramData%
install_file
XClient.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1740-1-0x0000000000FD0000-0x0000000001008000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2680	powershell.exe
2912	powershell.exe
2704	powershell.exe
3000	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	222f76224b428d25c8a16437f9d05309ea160816439f25dd5e5003b07ef294a6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	222f76224b428d25c8a16437f9d05309ea160816439f25dd5e5003b07ef294a6.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2680	powershell.exe
2912	powershell.exe
2704	powershell.exe
3000	powershell.exe
1740	222f76224b428d25c8a16437f9d05309ea160816439f25dd5e5003b07ef294a6.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1740	222f76224b428d25c8a16437f9d05309ea160816439f25dd5e5003b07ef294a6.exe
Token: SeDebugPrivilege	2680	powershell.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	3000	powershell.exe
Token: SeDebugPrivilege	1740	222f76224b428d25c8a16437f9d05309ea160816439f25dd5e5003b07ef294a6.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1740	222f76224b428d25c8a16437f9d05309ea160816439f25dd5e5003b07ef294a6.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2680	1740	222f76224b428d25c8a16437f9d05309ea160816439f25dd5e5003b07ef294a6.exe	32
PID 1740 wrote to memory of 2680	1740	222f76224b428d25c8a16437f9d05309ea160816439f25dd5e5003b07ef294a6.exe	32
PID 1740 wrote to memory of 2680	1740	222f76224b428d25c8a16437f9d05309ea160816439f25dd5e5003b07ef294a6.exe	32
PID 1740 wrote to memory of 2912	1740	222f76224b428d25c8a16437f9d05309ea160816439f25dd5e5003b07ef294a6.exe	34
PID 1740 wrote to memory of 2912	1740	222f76224b428d25c8a16437f9d05309ea160816439f25dd5e5003b07ef294a6.exe	34
PID 1740 wrote to memory of 2912	1740	222f76224b428d25c8a16437f9d05309ea160816439f25dd5e5003b07ef294a6.exe	34
PID 1740 wrote to memory of 2704	1740	222f76224b428d25c8a16437f9d05309ea160816439f25dd5e5003b07ef294a6.exe	36
PID 1740 wrote to memory of 2704	1740	222f76224b428d25c8a16437f9d05309ea160816439f25dd5e5003b07ef294a6.exe	36
PID 1740 wrote to memory of 2704	1740	222f76224b428d25c8a16437f9d05309ea160816439f25dd5e5003b07ef294a6.exe	36
PID 1740 wrote to memory of 3000	1740	222f76224b428d25c8a16437f9d05309ea160816439f25dd5e5003b07ef294a6.exe	38
PID 1740 wrote to memory of 3000	1740	222f76224b428d25c8a16437f9d05309ea160816439f25dd5e5003b07ef294a6.exe	38
PID 1740 wrote to memory of 3000	1740	222f76224b428d25c8a16437f9d05309ea160816439f25dd5e5003b07ef294a6.exe	38

C:\Users\Admin\AppData\Local\Temp\222f76224b428d25c8a16437f9d05309ea160816439f25dd5e5003b07ef294a6.exe
"C:\Users\Admin\AppData\Local\Temp\222f76224b428d25c8a16437f9d05309ea160816439f25dd5e5003b07ef294a6.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\222f76224b428d25c8a16437f9d05309ea160816439f25dd5e5003b07ef294a6.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '222f76224b428d25c8a16437f9d05309ea160816439f25dd5e5003b07ef294a6.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
a6c65f4c1583b11e48e78033e9d55b64

SHA1
ace8853cb9bbff31064408ae6f13f83d4fe6e430

SHA256
99e832d63d88a9bc367988b8ae0eb1406a71462dc27c076ff9cad4501b81ab8c

SHA512
a15cc21f5d348eff52defb7f124bee7508ecad0848f81e619135f60f3b2045b91ef5c26149d8e349b183e0f9a5a906106b8a4ba74d4f2ad1627295c969c275b6

Download Submit
memory/1740-0-0x000007FEF6063000-0x000007FEF6064000-memory.dmp

Filesize
4KB

Download
memory/1740-1-0x0000000000FD0000-0x0000000001008000-memory.dmp

Filesize
224KB

Download
memory/1740-2-0x000007FEF6060000-0x000007FEF6A4C000-memory.dmp

Filesize
9.9MB

Download
memory/1740-28-0x000007FEF6063000-0x000007FEF6064000-memory.dmp

Filesize
4KB

Download
memory/1740-33-0x000007FEF6060000-0x000007FEF6A4C000-memory.dmp

Filesize
9.9MB

Download
memory/2680-7-0x0000000002D70000-0x0000000002DF0000-memory.dmp

Filesize
512KB

Download
memory/2680-8-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/2680-9-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2912-15-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

Filesize
2.9MB

Download
memory/2912-16-0x0000000001BF0000-0x0000000001BF8000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing