xworm | 25d0b5d3b68e80dd26385aff712359be798badcf427e7835d71721b1ae777fce

General

Target

SearchFilterHo.exe
Size

849KB
MD5

6bf6eaaac80868bffef1004a3fa45c0f
SHA1

86451794016ed34f3be20f10fa9374b4d566ecb1
SHA256

25d0b5d3b68e80dd26385aff712359be798badcf427e7835d71721b1ae777fce
SHA512

ae5de6ee5a653d210f52e0e0e49532eb37b58e49a74abc322094de8d9a29a6d6effce0534241216a74c62ae0a4b3b8fb4d94bcee4827d1ca391f035fd4d88e93
SSDEEP

12288:XUQfymWBId3aco3NrBIPa9uLFRGFPqULhj93fzq8t5GpX:XUEdqcodNI+EFW1F9Pzq65GJ

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

C2

83.38.24.1:1603

Attributes

Install_directory
%Public%
install_file
SecurityHealthSystray.exe

Signatures

Detect Xworm Payload 10 IoCs

resource	yara_rule
behavioral2/files/0x000c000000023b6c-6.dat	family_xworm
behavioral2/files/0x0009000000023c59-35.dat	family_xworm
behavioral2/files/0x0007000000023c66-92.dat	family_xworm
behavioral2/memory/3244-147-0x0000000000AE0000-0x0000000000B22000-memory.dmp	family_xworm
behavioral2/memory/4696-153-0x0000000000230000-0x0000000000254000-memory.dmp	family_xworm
behavioral2/memory/3376-152-0x0000000000DE0000-0x0000000000DF4000-memory.dmp	family_xworm
behavioral2/files/0x0007000000023c67-149.dat	family_xworm
behavioral2/memory/5108-146-0x0000000000E20000-0x0000000000E48000-memory.dmp	family_xworm
behavioral2/files/0x0007000000023c65-142.dat	family_xworm
behavioral2/memory/4292-90-0x0000000000450000-0x0000000000482000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	SearchFilterHo.exe

Executes dropped EXE 5 IoCs

pid	Process
4292	OneDrive.exe
5108	SearchFilterHost.exe
3244	SecurityHealthSystray.exe
3376	svhost.exe
4696	WmiPrvSE.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4292	OneDrive.exe
Token: SeDebugPrivilege	5108	SearchFilterHost.exe
Token: SeDebugPrivilege	3244	SecurityHealthSystray.exe
Token: SeDebugPrivilege	3376	svhost.exe
Token: SeDebugPrivilege	4696	WmiPrvSE.exe
Token: SeDebugPrivilege	3504	taskmgr.exe
Token: SeSystemProfilePrivilege	3504	taskmgr.exe
Token: SeCreateGlobalPrivilege	3504	taskmgr.exe
Token: 33	3504	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3504	taskmgr.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe
3504	taskmgr.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 4292	2132	SearchFilterHo.exe	84
PID 2132 wrote to memory of 4292	2132	SearchFilterHo.exe	84
PID 2132 wrote to memory of 5108	2132	SearchFilterHo.exe	85
PID 2132 wrote to memory of 5108	2132	SearchFilterHo.exe	85
PID 2132 wrote to memory of 3244	2132	SearchFilterHo.exe	86
PID 2132 wrote to memory of 3244	2132	SearchFilterHo.exe	86
PID 2132 wrote to memory of 3376	2132	SearchFilterHo.exe	87
PID 2132 wrote to memory of 3376	2132	SearchFilterHo.exe	87
PID 2132 wrote to memory of 4696	2132	SearchFilterHo.exe	88
PID 2132 wrote to memory of 4696	2132	SearchFilterHo.exe	88

C:\Users\Admin\AppData\Local\Temp\SearchFilterHo.exe
"C:\Users\Admin\AppData\Local\Temp\SearchFilterHo.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Users\Admin\OneDrive.exe
  "C:\Users\Admin\OneDrive.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4292
- C:\Users\Admin\SearchFilterHost.exe
  "C:\Users\Admin\SearchFilterHost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5108
- C:\Users\Admin\SecurityHealthSystray.exe
  "C:\Users\Admin\SecurityHealthSystray.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3244
- C:\Users\Admin\svhost.exe
  "C:\Users\Admin\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3376
- C:\Users\Admin\WmiPrvSE.exe
  "C:\Users\Admin\WmiPrvSE.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4696

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\OneDrive.exe

Filesize
174KB

MD5
4a5eed221edf94019849f611973a5376

SHA1
0484d7a1fe2c4eb8013444016afbcae173020b6f

SHA256
b2b2fb1e247b886ab782763860bca0f2bf4e41eef16bf6e9e41b69e24605bf16

SHA512
2f590364fd6daf8b332579ee4d04816403de1cdd7c8df9422f14766f92603f80db43749ca86976879902ab923b18d58e42208d35c0c84986e7a91b6864fce8e3

Download Submit
C:\Users\Admin\SearchFilterHost.exe

Filesize
140KB

MD5
2aaa9d62fd4edb40e4ed11bc00c8fb03

SHA1
a754ede011b6ab6160f38abbc393cc9896ad0130

SHA256
95949d50cbe1539285141ed602a5f6043d2d2d2447ddd4bc991d2918cc73da6b

SHA512
c9c18d8ab6b404a9888a98be246f3a863279f0b49b6ff982fcbe0c4d83a2a696f7a3c3e18c7ec41cccc364e391802007d9a9bf6fe1c49146d71377b96c918c94

Download Submit
C:\Users\Admin\SecurityHealthSystray.exe

Filesize
240KB

MD5
dc3c3b862e58da1501e5c2a6c7996215

SHA1
7971922fcb52e5a6a68ca7647bb1d9840d173686

SHA256
1093b52ec29400724e79a1d4175013e6561c788709e58cc69e192e3d971ce319

SHA512
1dffe6eebfadde3a4c12fb7426f59c602f00195a0d5a3b5acf19d77429ce9ff6a6b78198b3cde935ad30ccec243cb9aa4a1a409700d722da2dc172cd9733331f

Download Submit
C:\Users\Admin\WmiPrvSE.exe

Filesize
124KB

MD5
f79800bf6bb985555b2c1ec111875104

SHA1
dbe7f0dcee1a701e4ae5f095f94d1b42c354fe31

SHA256
a368e93d24d8e156adb1f1800cbe31ad820fac04a9fcc0a15c8a716057ccdf87

SHA512
34cb03265366e021cab4aeb3166183d96735fdefd8bb79d9017304eaf50b031345330ef6da5570a372a8bfea6b5e65b15ecc24da59c8d968234d78773b571342

Download Submit
C:\Users\Admin\svhost.exe

Filesize
56KB

MD5
9371f877a385e2e442585e31b90dd76a

SHA1
3087f5a52409637384d5629f16316cf8d5927df4

SHA256
ea289415f918d635beb78fe3c156f78df9016989bb81e5c624f7cab61a68080a

SHA512
64b2eb9af5008191ab25460372a052baf5d5618ebc26a6504d201b84460d56a6cb092f70a799d2b9956c0c8b3575923ca6e6f58d09ae2dd014ab73e7bc1888f7

Download Submit
memory/2132-1-0x0000000000F70000-0x000000000104A000-memory.dmp

Filesize
872KB

Download
memory/2132-0-0x00007FFA81CC3000-0x00007FFA81CC5000-memory.dmp

Filesize
8KB

Download
memory/3244-147-0x0000000000AE0000-0x0000000000B22000-memory.dmp

Filesize
264KB

Download
memory/3244-157-0x000000001BE10000-0x000000001BF12000-memory.dmp

Filesize
1.0MB

Download
memory/3376-152-0x0000000000DE0000-0x0000000000DF4000-memory.dmp

Filesize
80KB

Download
memory/3376-156-0x000000001C070000-0x000000001C172000-memory.dmp

Filesize
1.0MB

Download
memory/3504-164-0x0000020F6A1D0000-0x0000020F6A1D1000-memory.dmp

Filesize
4KB

Download
memory/3504-173-0x0000020F6A1D0000-0x0000020F6A1D1000-memory.dmp

Filesize
4KB

Download
memory/3504-169-0x0000020F6A1D0000-0x0000020F6A1D1000-memory.dmp

Filesize
4KB

Download
memory/3504-170-0x0000020F6A1D0000-0x0000020F6A1D1000-memory.dmp

Filesize
4KB

Download
memory/3504-171-0x0000020F6A1D0000-0x0000020F6A1D1000-memory.dmp

Filesize
4KB

Download
memory/3504-172-0x0000020F6A1D0000-0x0000020F6A1D1000-memory.dmp

Filesize
4KB

Download
memory/3504-174-0x0000020F6A1D0000-0x0000020F6A1D1000-memory.dmp

Filesize
4KB

Download
memory/3504-175-0x0000020F6A1D0000-0x0000020F6A1D1000-memory.dmp

Filesize
4KB

Download
memory/3504-165-0x0000020F6A1D0000-0x0000020F6A1D1000-memory.dmp

Filesize
4KB

Download
memory/3504-163-0x0000020F6A1D0000-0x0000020F6A1D1000-memory.dmp

Filesize
4KB

Download
memory/4292-160-0x00007FFA81CC0000-0x00007FFA82781000-memory.dmp

Filesize
10.8MB

Download
memory/4292-151-0x00007FFA81CC0000-0x00007FFA82781000-memory.dmp

Filesize
10.8MB

Download
memory/4292-159-0x000000001B870000-0x000000001B972000-memory.dmp

Filesize
1.0MB

Download
memory/4292-90-0x0000000000450000-0x0000000000482000-memory.dmp

Filesize
200KB

Download
memory/4292-155-0x00007FFA81CC0000-0x00007FFA82781000-memory.dmp

Filesize
10.8MB

Download
memory/4696-153-0x0000000000230000-0x0000000000254000-memory.dmp

Filesize
144KB

Download
memory/4696-158-0x000000001B540000-0x000000001B642000-memory.dmp

Filesize
1.0MB

Download
memory/5108-162-0x00007FFA81CC0000-0x00007FFA82781000-memory.dmp

Filesize
10.8MB

Download
memory/5108-161-0x000000001C0F0000-0x000000001C1F2000-memory.dmp

Filesize
1.0MB

Download
memory/5108-146-0x0000000000E20000-0x0000000000E48000-memory.dmp

Filesize
160KB

Download
memory/5108-154-0x00007FFA81CC0000-0x00007FFA82781000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads