xworm | 8efa6f0711c60afd3e6cb29df2b740ee4d01b7f4290a223aa85c6f54fb3b9da5

General

Target

8efa6f0711c60afd3e6cb29df2b740ee4d01b7f4290a223aa85c6f54fb3b9da5.exe
Size

59KB
MD5

f2a18b995a82e938ab6a067491aa0d79
SHA1

d437fca2f38d712bafae8c92169eec8934699e54
SHA256

8efa6f0711c60afd3e6cb29df2b740ee4d01b7f4290a223aa85c6f54fb3b9da5
SHA512

73db4ec0271045f3f2c40fa197cf6300d81f32e4ecdddf792b475c8234d997c8d9ddfd62f944f230d8929017dfd1f473fbf4470f3bf6c2e92a8606cd3fed6d56
SSDEEP

1536:CcG/DG/fDG+wopontVm+4ys9bFKR4F+9E6ywbgOmXvkAq:CcGGfDG+wWoPm+4X9bFKac/0Omfbq

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

Attributes

Install_directory
%ProgramData%
install_file
winlogon.exe
pastebin_url
https://pastebin.com/raw/QUwdrCNg

Signatures

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral1/memory/2384-1-0x0000000001190000-0x00000000011A4000-memory.dmp	family_xworm
behavioral1/files/0x000a000000018710-32.dat	family_xworm
behavioral1/memory/2516-33-0x00000000010F0000-0x0000000001104000-memory.dmp	family_xworm
behavioral1/memory/2940-35-0x00000000013A0000-0x00000000013B4000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2732	powershell.exe
2784	powershell.exe
2388	powershell.exe
2820	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2516	winlogon.exe
2940	winlogon.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	pastebin.com
5	pastebin.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3048	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2384	8efa6f0711c60afd3e6cb29df2b740ee4d01b7f4290a223aa85c6f54fb3b9da5.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2388	powershell.exe
2820	powershell.exe
2732	powershell.exe
2784	powershell.exe
2384	8efa6f0711c60afd3e6cb29df2b740ee4d01b7f4290a223aa85c6f54fb3b9da5.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2384	8efa6f0711c60afd3e6cb29df2b740ee4d01b7f4290a223aa85c6f54fb3b9da5.exe
Token: SeDebugPrivilege	2388	powershell.exe
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeDebugPrivilege	2732	powershell.exe
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeDebugPrivilege	2384	8efa6f0711c60afd3e6cb29df2b740ee4d01b7f4290a223aa85c6f54fb3b9da5.exe
Token: SeDebugPrivilege	2516	winlogon.exe
Token: SeDebugPrivilege	2940	winlogon.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2384	8efa6f0711c60afd3e6cb29df2b740ee4d01b7f4290a223aa85c6f54fb3b9da5.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2388	2384	8efa6f0711c60afd3e6cb29df2b740ee4d01b7f4290a223aa85c6f54fb3b9da5.exe	30
PID 2384 wrote to memory of 2388	2384	8efa6f0711c60afd3e6cb29df2b740ee4d01b7f4290a223aa85c6f54fb3b9da5.exe	30
PID 2384 wrote to memory of 2388	2384	8efa6f0711c60afd3e6cb29df2b740ee4d01b7f4290a223aa85c6f54fb3b9da5.exe	30
PID 2384 wrote to memory of 2820	2384	8efa6f0711c60afd3e6cb29df2b740ee4d01b7f4290a223aa85c6f54fb3b9da5.exe	32
PID 2384 wrote to memory of 2820	2384	8efa6f0711c60afd3e6cb29df2b740ee4d01b7f4290a223aa85c6f54fb3b9da5.exe	32
PID 2384 wrote to memory of 2820	2384	8efa6f0711c60afd3e6cb29df2b740ee4d01b7f4290a223aa85c6f54fb3b9da5.exe	32
PID 2384 wrote to memory of 2732	2384	8efa6f0711c60afd3e6cb29df2b740ee4d01b7f4290a223aa85c6f54fb3b9da5.exe	34
PID 2384 wrote to memory of 2732	2384	8efa6f0711c60afd3e6cb29df2b740ee4d01b7f4290a223aa85c6f54fb3b9da5.exe	34
PID 2384 wrote to memory of 2732	2384	8efa6f0711c60afd3e6cb29df2b740ee4d01b7f4290a223aa85c6f54fb3b9da5.exe	34
PID 2384 wrote to memory of 2784	2384	8efa6f0711c60afd3e6cb29df2b740ee4d01b7f4290a223aa85c6f54fb3b9da5.exe	36
PID 2384 wrote to memory of 2784	2384	8efa6f0711c60afd3e6cb29df2b740ee4d01b7f4290a223aa85c6f54fb3b9da5.exe	36
PID 2384 wrote to memory of 2784	2384	8efa6f0711c60afd3e6cb29df2b740ee4d01b7f4290a223aa85c6f54fb3b9da5.exe	36
PID 2384 wrote to memory of 3048	2384	8efa6f0711c60afd3e6cb29df2b740ee4d01b7f4290a223aa85c6f54fb3b9da5.exe	38
PID 2384 wrote to memory of 3048	2384	8efa6f0711c60afd3e6cb29df2b740ee4d01b7f4290a223aa85c6f54fb3b9da5.exe	38
PID 2384 wrote to memory of 3048	2384	8efa6f0711c60afd3e6cb29df2b740ee4d01b7f4290a223aa85c6f54fb3b9da5.exe	38
PID 1388 wrote to memory of 2516	1388	taskeng.exe	42
PID 1388 wrote to memory of 2516	1388	taskeng.exe	42
PID 1388 wrote to memory of 2516	1388	taskeng.exe	42
PID 1388 wrote to memory of 2940	1388	taskeng.exe	43
PID 1388 wrote to memory of 2940	1388	taskeng.exe	43
PID 1388 wrote to memory of 2940	1388	taskeng.exe	43

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8efa6f0711c60afd3e6cb29df2b740ee4d01b7f4290a223aa85c6f54fb3b9da5.exe
"C:\Users\Admin\AppData\Local\Temp\8efa6f0711c60afd3e6cb29df2b740ee4d01b7f4290a223aa85c6f54fb3b9da5.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\8efa6f0711c60afd3e6cb29df2b740ee4d01b7f4290a223aa85c6f54fb3b9da5.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '8efa6f0711c60afd3e6cb29df2b740ee4d01b7f4290a223aa85c6f54fb3b9da5.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2784
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "winlogon" /tr "C:\ProgramData\winlogon.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3048

C:\Windows\system32\taskeng.exe
taskeng.exe {EB568EA4-EDE2-4E68-91D4-1093CCC99736} S-1-5-21-2703099537-420551529-3771253338-1000:XECUDNCD\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\ProgramData\winlogon.exe
  C:\ProgramData\winlogon.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2516
- C:\ProgramData\winlogon.exe
  C:\ProgramData\winlogon.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\winlogon.exe

Filesize
59KB

MD5
f2a18b995a82e938ab6a067491aa0d79

SHA1
d437fca2f38d712bafae8c92169eec8934699e54

SHA256
8efa6f0711c60afd3e6cb29df2b740ee4d01b7f4290a223aa85c6f54fb3b9da5

SHA512
73db4ec0271045f3f2c40fa197cf6300d81f32e4ecdddf792b475c8234d997c8d9ddfd62f944f230d8929017dfd1f473fbf4470f3bf6c2e92a8606cd3fed6d56

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7ZW1JPG7IUYKT300T3A4.temp

Filesize
7KB

MD5
1c7f0c112d1baec624e15ca89c98d92b

SHA1
2191f59f0e2c7e87a7b84ba077777af44d131ea2

SHA256
91c22aedffdb19a8b2e4530cfd2ff3ef3608b45fdca3101be719326fd54ee18f

SHA512
82db872fd5ce13c313e19d53bd8913639f5e5bab6d94b1abb6bc25db4bde2085e2eae4da178d17998f79d2315aa7a4f1682d3e87ccca5748384da43fda33b4f1

Download Submit
memory/2384-27-0x000000001B1B0000-0x000000001B230000-memory.dmp

Filesize
512KB

Download
memory/2384-1-0x0000000001190000-0x00000000011A4000-memory.dmp

Filesize
80KB

Download
memory/2384-0-0x000007FEF67C3000-0x000007FEF67C4000-memory.dmp

Filesize
4KB

Download
memory/2384-29-0x000000001B1B0000-0x000000001B230000-memory.dmp

Filesize
512KB

Download
memory/2384-28-0x000007FEF67C3000-0x000007FEF67C4000-memory.dmp

Filesize
4KB

Download
memory/2388-8-0x0000000002000000-0x0000000002008000-memory.dmp

Filesize
32KB

Download
memory/2388-7-0x000000001B710000-0x000000001B9F2000-memory.dmp

Filesize
2.9MB

Download
memory/2388-6-0x0000000002E20000-0x0000000002EA0000-memory.dmp

Filesize
512KB

Download
memory/2516-33-0x00000000010F0000-0x0000000001104000-memory.dmp

Filesize
80KB

Download
memory/2820-14-0x000000001B610000-0x000000001B8F2000-memory.dmp

Filesize
2.9MB

Download
memory/2820-15-0x0000000002720000-0x0000000002728000-memory.dmp

Filesize
32KB

Download
memory/2940-35-0x00000000013A0000-0x00000000013B4000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads