xworm | cbc725af77ebf25c61784ad3df87a4d42003492931562c3d6ca00c0726320f98

General

Target

CMDBITX_Crack__By_Rank1_Fix1.exe
Size

5.7MB
MD5

f5ca75b6deed282fb277bcd87dcf968d
SHA1

de0aafbc767308332795f0de7d59e30f1f1293fa
SHA256

cbc725af77ebf25c61784ad3df87a4d42003492931562c3d6ca00c0726320f98
SHA512

bffbe2cf79dfd4efdb760d3bb440f2ebbee7a1db6c4b6f87e19407efa597927f35766dfb23300890ce0f2c33e2f178c25423d6cd6bd3d1500574efd72e365f57
SSDEEP

98304:ezg8NHE04004RmgZKJG4HrC5rji6tXtNhUc9u70rhwt3FNHbJ5gJYNIi56LKAsYv:ezvdh40lRmwuG4Glt1Uy/t0Xb5NIiIAK

Score

10^/10

xworm rat trojan vmprotect

Malware Config

Extracted

Family

xworm

C2

85.203.4.149:7000

Attributes

Install_directory
%ProgramData%
install_file
XClient.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000c000000023b0f-6.dat	family_xworm
behavioral2/memory/3496-13-0x0000000000250000-0x0000000000268000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	CMDBITX_Crack__By_Rank1_Fix1.exe

Executes dropped EXE 2 IoCs

pid	Process
3496	svchost.exe
624	CMDBITX_Crack__By_Rank1_Fix1.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x000a000000023b6c-19.dat	vmprotect
behavioral2/memory/624-34-0x00007FF609FE0000-0x00007FF60A9AE000-memory.dmp	vmprotect
behavioral2/memory/624-37-0x00007FF609FE0000-0x00007FF60A9AE000-memory.dmp	vmprotect

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
624	CMDBITX_Crack__By_Rank1_Fix1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
624	CMDBITX_Crack__By_Rank1_Fix1.exe
624	CMDBITX_Crack__By_Rank1_Fix1.exe
624	CMDBITX_Crack__By_Rank1_Fix1.exe
624	CMDBITX_Crack__By_Rank1_Fix1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3496	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 3496	2516	CMDBITX_Crack__By_Rank1_Fix1.exe	84
PID 2516 wrote to memory of 3496	2516	CMDBITX_Crack__By_Rank1_Fix1.exe	84
PID 2516 wrote to memory of 624	2516	CMDBITX_Crack__By_Rank1_Fix1.exe	85
PID 2516 wrote to memory of 624	2516	CMDBITX_Crack__By_Rank1_Fix1.exe	85
PID 624 wrote to memory of 4064	624	CMDBITX_Crack__By_Rank1_Fix1.exe	88
PID 624 wrote to memory of 4064	624	CMDBITX_Crack__By_Rank1_Fix1.exe	88
PID 624 wrote to memory of 2172	624	CMDBITX_Crack__By_Rank1_Fix1.exe	90
PID 624 wrote to memory of 2172	624	CMDBITX_Crack__By_Rank1_Fix1.exe	90

C:\Users\Admin\AppData\Local\Temp\CMDBITX_Crack__By_Rank1_Fix1.exe
"C:\Users\Admin\AppData\Local\Temp\CMDBITX_Crack__By_Rank1_Fix1.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2516
- C:\ProgramData\svchost.exe
  "C:\ProgramData\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3496
- C:\ProgramData\CMDBITX_Crack__By_Rank1_Fix1.exe
  "C:\ProgramData\CMDBITX_Crack__By_Rank1_Fix1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\CMDBITX_Crack__By_Rank1_Fix1.exe

Filesize
5.6MB

MD5
b8706e3eec936f15bd7b4a957e6128cc

SHA1
861d963c4535ad565656c966e179e2386d29cbfa

SHA256
aa8bddd86d728e417ab54f6b34f1dc7ed6f48d4a6229e1d452abce07f1e7b747

SHA512
5a0975d5086799f7856ebdf84c64111b6de07e3b7a8af7c9cb5b753cb8e8f2ac913c0578073bb9c224ef8c54c279bde7bfdf35d96f5266142966297497419a7e

Download Submit
C:\ProgramData\svchost.exe

Filesize
73KB

MD5
a85dd5e8817d7d7027496450b609c35d

SHA1
f7045eab4bcb8a557efc4b08630be324f791d45b

SHA256
7298148e9b7339323d19babc0b1408f3a680d777c7de5680b0bb898987e5ef9b

SHA512
1712c6bb38bd748bd83bf79610f8b398126a358c944d9c881f126e94630e4c30477e2101f786c3355bd91727be8da10ea9820a9f18f17023ec8eea40f81260ac

Download Submit
memory/624-34-0x00007FF609FE0000-0x00007FF60A9AE000-memory.dmp

Filesize
9.8MB

Download
memory/624-27-0x00007FF60A088000-0x00007FF60A40C000-memory.dmp

Filesize
3.5MB

Download
memory/624-28-0x00007FF934BB0000-0x00007FF934BB2000-memory.dmp

Filesize
8KB

Download
memory/624-29-0x00007FF934BC0000-0x00007FF934BC2000-memory.dmp

Filesize
8KB

Download
memory/624-36-0x00007FF60A088000-0x00007FF60A40C000-memory.dmp

Filesize
3.5MB

Download
memory/624-37-0x00007FF609FE0000-0x00007FF60A9AE000-memory.dmp

Filesize
9.8MB

Download
memory/2516-1-0x00000000005E0000-0x0000000000B9C000-memory.dmp

Filesize
5.7MB

Download
memory/2516-0-0x00007FF916683000-0x00007FF916685000-memory.dmp

Filesize
8KB

Download
memory/3496-13-0x0000000000250000-0x0000000000268000-memory.dmp

Filesize
96KB

Download
memory/3496-14-0x00007FF916680000-0x00007FF917141000-memory.dmp

Filesize
10.8MB

Download
memory/3496-35-0x00007FF916680000-0x00007FF917141000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing