xworm | 7d89b01bf15634fe03d943e73e5ee8e5cc04079c99c3d2635948bead2f179c21

General

Target

7d89b01bf15634fe03d943e73e5ee8e5cc04079c99c3d2635948bead2f179c21.exe
Size

65KB
MD5

9486aecf42021df267cdd56c3b7c3ea8
SHA1

8e97adc394a405b9a19d6d5c105f98f65b79dfba
SHA256

7d89b01bf15634fe03d943e73e5ee8e5cc04079c99c3d2635948bead2f179c21
SHA512

51e851a81874bc23613e4d360011c480db4e2a718f16a299bac81f28018a712a1e038a2f71595a426933e89602284f0a35f00a2aa25dd8cf320cb782d7d17419
SSDEEP

1536:saxVFH+GAGkDJ0iqp8He+bDLSpX4Ytp56d29Oh6GY:sak6kDJ0ge+bDL1YtpesOh9Y

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

22.ip.gl.ply.gg:34382

127.0.0.1:34382

Attributes

Install_directory
%AppData%
install_file
svchost.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1292-1-0x00000000002B0000-0x00000000002C6000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
780	powershell.exe
2780	powershell.exe
2800	powershell.exe
2548	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	7d89b01bf15634fe03d943e73e5ee8e5cc04079c99c3d2635948bead2f179c21.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	7d89b01bf15634fe03d943e73e5ee8e5cc04079c99c3d2635948bead2f179c21.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	7d89b01bf15634fe03d943e73e5ee8e5cc04079c99c3d2635948bead2f179c21.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2548	powershell.exe
780	powershell.exe
2780	powershell.exe
2800	powershell.exe
1292	7d89b01bf15634fe03d943e73e5ee8e5cc04079c99c3d2635948bead2f179c21.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1292	7d89b01bf15634fe03d943e73e5ee8e5cc04079c99c3d2635948bead2f179c21.exe
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeDebugPrivilege	780	powershell.exe
Token: SeDebugPrivilege	2780	powershell.exe
Token: SeDebugPrivilege	2800	powershell.exe
Token: SeDebugPrivilege	1292	7d89b01bf15634fe03d943e73e5ee8e5cc04079c99c3d2635948bead2f179c21.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1292	7d89b01bf15634fe03d943e73e5ee8e5cc04079c99c3d2635948bead2f179c21.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 2548	1292	7d89b01bf15634fe03d943e73e5ee8e5cc04079c99c3d2635948bead2f179c21.exe	30
PID 1292 wrote to memory of 2548	1292	7d89b01bf15634fe03d943e73e5ee8e5cc04079c99c3d2635948bead2f179c21.exe	30
PID 1292 wrote to memory of 2548	1292	7d89b01bf15634fe03d943e73e5ee8e5cc04079c99c3d2635948bead2f179c21.exe	30
PID 1292 wrote to memory of 780	1292	7d89b01bf15634fe03d943e73e5ee8e5cc04079c99c3d2635948bead2f179c21.exe	32
PID 1292 wrote to memory of 780	1292	7d89b01bf15634fe03d943e73e5ee8e5cc04079c99c3d2635948bead2f179c21.exe	32
PID 1292 wrote to memory of 780	1292	7d89b01bf15634fe03d943e73e5ee8e5cc04079c99c3d2635948bead2f179c21.exe	32
PID 1292 wrote to memory of 2780	1292	7d89b01bf15634fe03d943e73e5ee8e5cc04079c99c3d2635948bead2f179c21.exe	34
PID 1292 wrote to memory of 2780	1292	7d89b01bf15634fe03d943e73e5ee8e5cc04079c99c3d2635948bead2f179c21.exe	34
PID 1292 wrote to memory of 2780	1292	7d89b01bf15634fe03d943e73e5ee8e5cc04079c99c3d2635948bead2f179c21.exe	34
PID 1292 wrote to memory of 2800	1292	7d89b01bf15634fe03d943e73e5ee8e5cc04079c99c3d2635948bead2f179c21.exe	36
PID 1292 wrote to memory of 2800	1292	7d89b01bf15634fe03d943e73e5ee8e5cc04079c99c3d2635948bead2f179c21.exe	36
PID 1292 wrote to memory of 2800	1292	7d89b01bf15634fe03d943e73e5ee8e5cc04079c99c3d2635948bead2f179c21.exe	36

C:\Users\Admin\AppData\Local\Temp\7d89b01bf15634fe03d943e73e5ee8e5cc04079c99c3d2635948bead2f179c21.exe
"C:\Users\Admin\AppData\Local\Temp\7d89b01bf15634fe03d943e73e5ee8e5cc04079c99c3d2635948bead2f179c21.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\7d89b01bf15634fe03d943e73e5ee8e5cc04079c99c3d2635948bead2f179c21.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '7d89b01bf15634fe03d943e73e5ee8e5cc04079c99c3d2635948bead2f179c21.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
849b2483c5f7533537c0b835ea226476

SHA1
09bdb14d0436e90c7ceb554667426379ed65e5a5

SHA256
0f9815e538ff1f7ce0d80c28e7e9a439c2171e559539eabb9019d9724fce4acf

SHA512
cd400c7986456ce3734992c78099911752a2be5f376a6a6cdb78af496372f46dc6db99d06f992ffd8afd1b0a0442aa45b479d8b6e773b67c3ad1c94d78a39cb4

Download Submit
memory/780-15-0x0000000002A70000-0x0000000002A78000-memory.dmp

Filesize
32KB

Download
memory/780-14-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

Filesize
2.9MB

Download
memory/1292-0-0x000007FEF5703000-0x000007FEF5704000-memory.dmp

Filesize
4KB

Download
memory/1292-1-0x00000000002B0000-0x00000000002C6000-memory.dmp

Filesize
88KB

Download
memory/1292-31-0x000000001B0C0000-0x000000001B140000-memory.dmp

Filesize
512KB

Download
memory/1292-32-0x000007FEF5703000-0x000007FEF5704000-memory.dmp

Filesize
4KB

Download
memory/1292-33-0x000000001B0C0000-0x000000001B140000-memory.dmp

Filesize
512KB

Download
memory/2548-6-0x0000000002890000-0x0000000002910000-memory.dmp

Filesize
512KB

Download
memory/2548-7-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Filesize
2.9MB

Download
memory/2548-8-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads