xworm | 490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3

General

Target

490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe
Size

41KB
MD5

5c48fe3471cf8db3c8c1cc1278566ec7
SHA1

ec5b1513df34018699823939858846dceed347a7
SHA256

490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3
SHA512

ac91cd0780099d02ee3d57962439812d5a5c147177caabbddedf2da274720c953543de7b8ce33d83cde8a5b9043736c75eac17779940292e5fa3024ca048320d
SSDEEP

768:tCJu44/aeqvujYXJMs5afEHDmaFWPa926OwhZZameu:tgu44/imwKsEfapFv926OwRzeu

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

copy-nigeria.gl.at.ply.gg:21026

Mutex

hHrxBd1WbcJItcMM

Attributes

Install_directory
%ProgramData%
install_file
Desktop Windows Manager.exe
telegram
https://api.telegram.org/bot7269786725:AAF0IPx1BWTdW_vbZqP8HGNrxWWFpF5CvYs/sendMessage?chat_id=5465523859

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1208-1-0x0000000000220000-0x0000000000230000-memory.dmp	family_xworm
C:\ProgramData\Desktop Windows Manager.exe	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe

Drops startup file 2 IoCs

Processes:

490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Desktop Windows Manager.lnk	490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Desktop Windows Manager.lnk	490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe

Executes dropped EXE 1 IoCs

Processes:

Desktop Windows Manager.exe

pid process

2336 Desktop Windows Manager.exe

pid	process
2336	Desktop Windows Manager.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Desktop Windows Manager = "C:\\ProgramData\\Desktop Windows Manager.exe"	490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3324 timeout.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

3080 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe

pid process

1208 490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe

pid	process
3324	timeout.exe

pid	process
3080	schtasks.exe

pid	process
1208	490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exeDesktop Windows Manager.exe

description	pid	process
Token: SeDebugPrivilege	1208	490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe
Token: SeDebugPrivilege	1208	490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe
Token: SeDebugPrivilege	2336	Desktop Windows Manager.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe

pid process

1208 490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe

pid	process
1208	490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.execmd.exe

description	pid	process	target process
PID 1208 wrote to memory of 3080	1208	490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe	schtasks.exe
PID 1208 wrote to memory of 3080	1208	490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe	schtasks.exe
PID 1208 wrote to memory of 3856	1208	490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe	schtasks.exe
PID 1208 wrote to memory of 3856	1208	490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe	schtasks.exe
PID 1208 wrote to memory of 1012	1208	490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe	cmd.exe
PID 1208 wrote to memory of 1012	1208	490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe	cmd.exe
PID 1012 wrote to memory of 3324	1012	cmd.exe	timeout.exe
PID 1012 wrote to memory of 3324	1012	cmd.exe	timeout.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe
"C:\Users\Admin\AppData\Local\Temp\490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Desktop Windows Manager" /tr "C:\ProgramData\Desktop Windows Manager.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3080
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /f /tn "Desktop Windows Manager"
  2⤵
  PID:3856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD215.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1012
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:3324

C:\ProgramData\Desktop Windows Manager.exe
"C:\ProgramData\Desktop Windows Manager.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Desktop Windows Manager.exe

Filesize
41KB

MD5
5c48fe3471cf8db3c8c1cc1278566ec7

SHA1
ec5b1513df34018699823939858846dceed347a7

SHA256
490865c96b82805a395497c5d870743b4fb9b2b9f3de548193a9dceaa11395a3

SHA512
ac91cd0780099d02ee3d57962439812d5a5c147177caabbddedf2da274720c953543de7b8ce33d83cde8a5b9043736c75eac17779940292e5fa3024ca048320d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD215.tmp.bat

Filesize
216B

MD5
fba0afaaa8793615d512d78509bbf833

SHA1
35578db4b9f9d51d88c03871ba03433a5f5a6f42

SHA256
6b3589ddcd4fd99dd6cc3af7244b8ac979bbbc997afc058f5a14d31e77e57a63

SHA512
b1152b1ed4d9f0145095fe6d37ae301455c85daf0e417ac33ab6ebc92d6c3e2171ad25532475ade8a3ff0790299ca9d1e769af7935d2b7cad7159d64c9cb10e9

Download Submit
memory/1208-1-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/1208-0-0x00007FFFDA613000-0x00007FFFDA615000-memory.dmp

Filesize
8KB

Download
memory/1208-6-0x00007FFFDA610000-0x00007FFFDB0D1000-memory.dmp

Filesize
10.8MB

Download
memory/1208-7-0x00007FFFDA613000-0x00007FFFDA615000-memory.dmp

Filesize
8KB

Download
memory/1208-13-0x00007FFFDA610000-0x00007FFFDB0D1000-memory.dmp

Filesize
10.8MB

Download
memory/1208-19-0x00007FFFDA610000-0x00007FFFDB0D1000-memory.dmp

Filesize
10.8MB

Download
memory/2336-10-0x00007FFFDA610000-0x00007FFFDB0D1000-memory.dmp

Filesize
10.8MB

Download
memory/2336-12-0x00007FFFDA610000-0x00007FFFDB0D1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads