xworm | 18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7b

General

Target

18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
Size

564KB
MD5

31e2c53b5bf4d2dbb52412efbfc8bf00
SHA1

4cd7735b817535352add043aae894473976af918
SHA256

18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7b
SHA512

76acdfab2ff25ec3d52ab30357c55d35977af12057363638e1da614dc8584c4282482e7bad37620894c4349ef921947f34fb44b53531b5c5deea57aa1056ca76
SSDEEP

12288:2AYaDPw1Qk89Tmyd+rCiw9DWTXnrCCcVXVz4klvTkR:2+Lw9gTFoQKLVcJ4klO

Score

10^/10

xworm discovery execution rat trojan

Malware Config

Extracted

Family

xworm

Version

3.1

C2

aye2mar280502016.ddns.net:4030

Mutex

6Ramn2bVtVXcTWn8

Attributes

Install_directory
%AppData%
install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 5 IoCs

resource	yara_rule
behavioral1/memory/2700-11-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm
behavioral1/memory/2700-10-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm
behavioral1/memory/2700-19-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm
behavioral1/memory/2700-16-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm
behavioral1/memory/2700-14-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2704	powershell.exe
2600	powershell.exe
688	powershell.exe
1968	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.lnk	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.lnk	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe

Loads dropped DLL 1 IoCs

pid	Process
2700	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2092 set thread context of 2700	2092	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2092	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
2092	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
2092	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
2092	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
2092	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
2092	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
2092	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
2092	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
2092	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
2092	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
2704	powershell.exe
2600	powershell.exe
688	powershell.exe
1968	powershell.exe
2700	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2092	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
Token: SeDebugPrivilege	2700	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	688	powershell.exe
Token: SeDebugPrivilege	1968	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2700	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2704	2092	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	31
PID 2092 wrote to memory of 2704	2092	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	31
PID 2092 wrote to memory of 2704	2092	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	31
PID 2092 wrote to memory of 2704	2092	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	31
PID 2092 wrote to memory of 2700	2092	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	33
PID 2092 wrote to memory of 2700	2092	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	33
PID 2092 wrote to memory of 2700	2092	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	33
PID 2092 wrote to memory of 2700	2092	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	33
PID 2092 wrote to memory of 2700	2092	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	33
PID 2092 wrote to memory of 2700	2092	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	33
PID 2092 wrote to memory of 2700	2092	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	33
PID 2092 wrote to memory of 2700	2092	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	33
PID 2092 wrote to memory of 2700	2092	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	33
PID 2700 wrote to memory of 2600	2700	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	34
PID 2700 wrote to memory of 2600	2700	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	34
PID 2700 wrote to memory of 2600	2700	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	34
PID 2700 wrote to memory of 2600	2700	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	34
PID 2700 wrote to memory of 688	2700	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	36
PID 2700 wrote to memory of 688	2700	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	36
PID 2700 wrote to memory of 688	2700	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	36
PID 2700 wrote to memory of 688	2700	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	36
PID 2700 wrote to memory of 1968	2700	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	38
PID 2700 wrote to memory of 1968	2700	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	38
PID 2700 wrote to memory of 1968	2700	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	38
PID 2700 wrote to memory of 1968	2700	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	38

C:\Users\Admin\AppData\Local\Temp\18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
"C:\Users\Admin\AppData\Local\Temp\18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2704
- C:\Users\Admin\AppData\Local\Temp\18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
  "C:\Users\Admin\AppData\Local\Temp\18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2600
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:688
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
2b50b9cf1078bf9fbea0db752feb405d

SHA1
43fb8b265ed0d0e61ea490b4af7f32d0c8f0bab9

SHA256
af52011ddea8e20991b97a8dc992fc73cfad2cc8910b50d3202b46947d4ebb76

SHA512
53a1c26062996d954fabce10a63ad35e328b5ffc3f21c15ede07f141ef7cc17dcf1e2e373f041e604ba64a564e0904977ffe86cef3dfe6f360ca9eced0cf42fc

Download Submit
\Users\Admin\AppData\Roaming\18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe

Filesize
564KB

MD5
31e2c53b5bf4d2dbb52412efbfc8bf00

SHA1
4cd7735b817535352add043aae894473976af918

SHA256
18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7b

SHA512
76acdfab2ff25ec3d52ab30357c55d35977af12057363638e1da614dc8584c4282482e7bad37620894c4349ef921947f34fb44b53531b5c5deea57aa1056ca76

Download Submit
memory/2092-0-0x000000007440E000-0x000000007440F000-memory.dmp

Filesize
4KB

Download
memory/2092-1-0x0000000001290000-0x0000000001320000-memory.dmp

Filesize
576KB

Download
memory/2092-2-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download
memory/2092-3-0x0000000000550000-0x000000000056E000-memory.dmp

Filesize
120KB

Download
memory/2092-4-0x000000007440E000-0x000000007440F000-memory.dmp

Filesize
4KB

Download
memory/2092-5-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download
memory/2092-6-0x0000000000200000-0x0000000000250000-memory.dmp

Filesize
320KB

Download
memory/2092-21-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download
memory/2700-7-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2700-19-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2700-16-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2700-14-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2700-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2700-20-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download
memory/2700-9-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2700-10-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2700-11-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2700-44-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download
memory/2700-45-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download
memory/2700-46-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing