xworm | 490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3

General

Target

490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe
Size

41KB
MD5

5c48fe3471cf8db3c8c1cc1278566ec7
SHA1

ec5b1513df34018699823939858846dceed347a7
SHA256

490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3
SHA512

ac91cd0780099d02ee3d57962439812d5a5c147177caabbddedf2da274720c953543de7b8ce33d83cde8a5b9043736c75eac17779940292e5fa3024ca048320d
SSDEEP

768:tCJu44/aeqvujYXJMs5afEHDmaFWPa926OwhZZameu:tgu44/imwKsEfapFv926OwRzeu

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

copy-nigeria.gl.at.ply.gg:21026

Mutex

hHrxBd1WbcJItcMM

Attributes

Install_directory
%ProgramData%
install_file
Desktop Windows Manager.exe
telegram
https://api.telegram.org/bot7269786725:AAF0IPx1BWTdW_vbZqP8HGNrxWWFpF5CvYs/sendMessage?chat_id=5465523859

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4540-1-0x00000000008A0000-0x00000000008B0000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe

Drops startup file 2 IoCs

Processes:

490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Desktop Windows Manager.lnk	490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Desktop Windows Manager.lnk	490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Desktop Windows Manager = "C:\\ProgramData\\Desktop Windows Manager.exe"	490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1864 timeout.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

3068 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe

pid process

4540 490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe

pid	process
1864	timeout.exe

pid	process
3068	schtasks.exe

pid	process
4540	490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe

description	pid	process
Token: SeDebugPrivilege	4540	490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe
Token: SeDebugPrivilege	4540	490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe

pid process

4540 490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe

pid	process
4540	490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.execmd.exe

description	pid	process	target process
PID 4540 wrote to memory of 3068	4540	490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe	schtasks.exe
PID 4540 wrote to memory of 3068	4540	490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe	schtasks.exe
PID 4540 wrote to memory of 4788	4540	490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe	schtasks.exe
PID 4540 wrote to memory of 4788	4540	490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe	schtasks.exe
PID 4540 wrote to memory of 2244	4540	490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe	cmd.exe
PID 4540 wrote to memory of 2244	4540	490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe	cmd.exe
PID 2244 wrote to memory of 1864	2244	cmd.exe	timeout.exe
PID 2244 wrote to memory of 1864	2244	cmd.exe	timeout.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe
"C:\Users\Admin\AppData\Local\Temp\490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Desktop Windows Manager" /tr "C:\ProgramData\Desktop Windows Manager.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3068
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /f /tn "Desktop Windows Manager"
  2⤵
  PID:4788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF935.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF935.tmp.bat

Filesize
216B

MD5
2c536bca9235e7802fd139d258a97d76

SHA1
d3ba79b46cfea81390f94ee45fa652f6f72d0249

SHA256
b19e1b7c0d4fabd993c8c37956d18d6d5cb9ab524dbf6486dc469c1c36ac5f4d

SHA512
b29b3e881f9c83c61e5a836230813f0d08085f06725ecd597c0290cbd2aee51d9e9d944d775918df3f1b1eb0ddf62aa42140705ff401c49468e7af62c37a5d5c

Download Submit
memory/4540-0-0x00007FF81EDB3000-0x00007FF81EDB5000-memory.dmp

Filesize
8KB

Download
memory/4540-1-0x00000000008A0000-0x00000000008B0000-memory.dmp

Filesize
64KB

Download
memory/4540-6-0x00007FF81EDB0000-0x00007FF81F871000-memory.dmp

Filesize
10.8MB

Download
memory/4540-7-0x00007FF81EDB3000-0x00007FF81EDB5000-memory.dmp

Filesize
8KB

Download
memory/4540-8-0x00007FF81EDB0000-0x00007FF81F871000-memory.dmp

Filesize
10.8MB

Download
memory/4540-15-0x00007FF81EDB0000-0x00007FF81F871000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads