xworm | 8fa2ab71f2e7c4276167c217778c01dedf71053bf9d4cee5274e8c077ef327dd

General

Target

8fa2ab71f2e7c4276167c217778c01dedf71053bf9d4cee5274e8c077ef327dd.js
Size

1.4MB
MD5

3094dc3bf3dacc07b7ae62e6cb53e02d
SHA1

7ff5441adf6b751704534c979046d5698dfdfdb1
SHA256

8fa2ab71f2e7c4276167c217778c01dedf71053bf9d4cee5274e8c077ef327dd
SHA512

48ba866defc3f817f8f043908eba4d8eec59d4f9af82c16184c95040c5d099c199999365f86d39619bd1c90e19d4a35f9f0b7292ff50ab1e69f161f363c46aab
SSDEEP

1536:u3BYP+9LHqamUMgVSnD5MOUbsNZoxOhjPFi/nZky:aM+9jDWgVSnD5QQNZDhjdi/1

Score

10^/10

xworm discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

kizitodavina.duckdns.org:8645

Mutex

oTbTivRCYmlY7umi

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3412-15-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 2 IoCs

pid	Process
2312	fzP.exe
3412	fzP.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fzP.exe"	fzP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\Service.exe"	fzP.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2312 set thread context of 3412	2312	fzP.exe	86

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzP.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3412	fzP.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3412	fzP.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3412	fzP.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 2312	4532	wscript.exe	85
PID 4532 wrote to memory of 2312	4532	wscript.exe	85
PID 4532 wrote to memory of 2312	4532	wscript.exe	85
PID 2312 wrote to memory of 3412	2312	fzP.exe	86
PID 2312 wrote to memory of 3412	2312	fzP.exe	86
PID 2312 wrote to memory of 3412	2312	fzP.exe	86
PID 2312 wrote to memory of 3412	2312	fzP.exe	86
PID 2312 wrote to memory of 3412	2312	fzP.exe	86
PID 2312 wrote to memory of 3412	2312	fzP.exe	86
PID 2312 wrote to memory of 3412	2312	fzP.exe	86
PID 2312 wrote to memory of 3412	2312	fzP.exe	86

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\8fa2ab71f2e7c4276167c217778c01dedf71053bf9d4cee5274e8c077ef327dd.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Users\Admin\AppData\Local\Temp\fzP.exe
  "C:\Users\Admin\AppData\Local\Temp\fzP.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Users\Admin\AppData\Local\Temp\fzP.exe
    "C:\Users\Admin\AppData\Local\Temp\fzP.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

JavaScript

1

T1059.007

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fzP.exe

Filesize
50KB

MD5
e69512e47d3a857de921fdb578cc6143

SHA1
75d4bb693ea678de775c8bc99c96c08ab8a5e4f3

SHA256
293b83f50094aa4c13386baeb17f533b0e7f1b6b39bdaea71df2ff7bd5fc4233

SHA512
2a8ff068b8b2386bc68c23692e59ee9d9e7e18ccdd1e0b175d59141962bd623ea03d37dc69103e495484aa09479f59a12e7bacf5d7d9ceaabdbddda4813a4c56

Download Submit
memory/2312-22-0x0000000075230000-0x00000000759E0000-memory.dmp

Filesize
7.7MB

Download
memory/2312-11-0x000000007523E000-0x000000007523F000-memory.dmp

Filesize
4KB

Download
memory/2312-12-0x00000000000B0000-0x00000000000C2000-memory.dmp

Filesize
72KB

Download
memory/2312-13-0x0000000005030000-0x00000000055D4000-memory.dmp

Filesize
5.6MB

Download
memory/2312-14-0x0000000004A10000-0x0000000004A18000-memory.dmp

Filesize
32KB

Download
memory/2312-18-0x0000000075230000-0x00000000759E0000-memory.dmp

Filesize
7.7MB

Download
memory/3412-15-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3412-21-0x0000000075230000-0x00000000759E0000-memory.dmp

Filesize
7.7MB

Download
memory/3412-20-0x0000000004CE0000-0x0000000004D7C000-memory.dmp

Filesize
624KB

Download
memory/3412-23-0x0000000075230000-0x00000000759E0000-memory.dmp

Filesize
7.7MB

Download
memory/3412-24-0x00000000052E0000-0x0000000005372000-memory.dmp

Filesize
584KB

Download
memory/3412-25-0x0000000005500000-0x000000000550A000-memory.dmp

Filesize
40KB

Download
memory/3412-26-0x0000000075230000-0x00000000759E0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads