xworm | cfe0edec47b69e6806e6d19a7aab72b4c952efd5ca993e64ee3da44a99456a4d

Analysis

max time kernel
2695s
max time network
2699s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

polishclub.exe
Size

34KB
MD5

8a1e00f00d6ac52747aa1dbeeb6afe8f
SHA1

8628de10d78a09956d1af140ba9ef3ebd19c02b1
SHA256

cfe0edec47b69e6806e6d19a7aab72b4c952efd5ca993e64ee3da44a99456a4d
SHA512

dec65379bdd78d6c35e1669e33a6acf1bb6666ab594ce9fc88b50e222fc356601ac84b918eabe74538d349067060fdc143ed4f77005a103947908cb3b015fde6
SSDEEP

384:ASyXlquOae6oKoBmoDnnGvBLmlgCwvHixdTD2VR8pkFTBLTIZwYGDcvw9IkuisRN:3yXiBDAtYgC4CaV9FZ9jENLOjho/4g

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

lefferek-42016.portmap.host:61672

budget-compiled.gl.at.ply.gg:61672

Mutex

BaJPVrZJtjd9S7m2

Attributes

Install_directory
%AppData%
install_file
DiscordClient.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral3/memory/1924-1-0x0000000000800000-0x000000000080E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiscordClient.lnk	polishclub.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiscordClient.lnk	polishclub.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1924	polishclub.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1924	polishclub.exe

C:\Users\Admin\AppData\Local\Temp\polishclub.exe
"C:\Users\Admin\AppData\Local\Temp\polishclub.exe"
1⤵
- Drops startup file
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1924-0-0x00007FFAF9093000-0x00007FFAF9095000-memory.dmp

Filesize
8KB

Download
memory/1924-1-0x0000000000800000-0x000000000080E000-memory.dmp

Filesize
56KB

Download
memory/1924-6-0x00007FFAF9090000-0x00007FFAF9B51000-memory.dmp

Filesize
10.8MB

Download
memory/1924-7-0x00007FFAF9093000-0x00007FFAF9095000-memory.dmp

Filesize
8KB

Download
memory/1924-8-0x00007FFAF9090000-0x00007FFAF9B51000-memory.dmp

Filesize
10.8MB

Download