xworm | 18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7b

General

Target

18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
Size

564KB
MD5

31e2c53b5bf4d2dbb52412efbfc8bf00
SHA1

4cd7735b817535352add043aae894473976af918
SHA256

18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7b
SHA512

76acdfab2ff25ec3d52ab30357c55d35977af12057363638e1da614dc8584c4282482e7bad37620894c4349ef921947f34fb44b53531b5c5deea57aa1056ca76
SSDEEP

12288:2AYaDPw1Qk89Tmyd+rCiw9DWTXnrCCcVXVz4klvTkR:2+Lw9gTFoQKLVcJ4klO

Score

10^/10

xworm discovery execution rat trojan

Malware Config

Extracted

Family

xworm

Version

3.1

C2

aye2mar280502016.ddns.net:4030

Mutex

6Ramn2bVtVXcTWn8

Attributes

Install_directory
%AppData%
install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 5 IoCs

resource	yara_rule
behavioral1/memory/2696-19-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm
behavioral1/memory/2696-17-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm
behavioral1/memory/2696-15-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm
behavioral1/memory/2696-12-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm
behavioral1/memory/2696-11-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2932	powershell.exe
1780	powershell.exe
3044	powershell.exe
1320	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.lnk	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.lnk	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe

Loads dropped DLL 1 IoCs

pid	Process
2696	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2956 set thread context of 2696	2956	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2956	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
2956	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
2956	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
2956	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
2956	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
2956	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
2956	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
2956	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
2956	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
2932	powershell.exe
1780	powershell.exe
3044	powershell.exe
1320	powershell.exe
2696	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2956	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
Token: SeDebugPrivilege	2696	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
Token: SeDebugPrivilege	2932	powershell.exe
Token: SeDebugPrivilege	1780	powershell.exe
Token: SeDebugPrivilege	3044	powershell.exe
Token: SeDebugPrivilege	1320	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2696	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2932	2956	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	30
PID 2956 wrote to memory of 2932	2956	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	30
PID 2956 wrote to memory of 2932	2956	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	30
PID 2956 wrote to memory of 2932	2956	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	30
PID 2956 wrote to memory of 2696	2956	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	32
PID 2956 wrote to memory of 2696	2956	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	32
PID 2956 wrote to memory of 2696	2956	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	32
PID 2956 wrote to memory of 2696	2956	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	32
PID 2956 wrote to memory of 2696	2956	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	32
PID 2956 wrote to memory of 2696	2956	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	32
PID 2956 wrote to memory of 2696	2956	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	32
PID 2956 wrote to memory of 2696	2956	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	32
PID 2956 wrote to memory of 2696	2956	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	32
PID 2696 wrote to memory of 1780	2696	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	34
PID 2696 wrote to memory of 1780	2696	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	34
PID 2696 wrote to memory of 1780	2696	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	34
PID 2696 wrote to memory of 1780	2696	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	34
PID 2696 wrote to memory of 3044	2696	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	36
PID 2696 wrote to memory of 3044	2696	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	36
PID 2696 wrote to memory of 3044	2696	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	36
PID 2696 wrote to memory of 3044	2696	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	36
PID 2696 wrote to memory of 1320	2696	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	38
PID 2696 wrote to memory of 1320	2696	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	38
PID 2696 wrote to memory of 1320	2696	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	38
PID 2696 wrote to memory of 1320	2696	18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe	38

C:\Users\Admin\AppData\Local\Temp\18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
"C:\Users\Admin\AppData\Local\Temp\18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2932
- C:\Users\Admin\AppData\Local\Temp\18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe
  "C:\Users\Admin\AppData\Local\Temp\18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1780
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3044
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
7d5ace3afb9fc0b4b61ec5c2ab2a785c

SHA1
593d656af17b99cb8cb311e327219831f398cf58

SHA256
bc840fad90e7e71ecab88e5d39db2b74130c363a07305ddd3a3c9c5d9eb7d73b

SHA512
7aed9f02c28ad4de75cbdd57b1d2608b5ed62dc46a4b6be8b0b68414b5ef4637a2fde5be3a707935c1202706ee65722a58fca5408ee609d7e8162d950b103056

Download Submit
\Users\Admin\AppData\Roaming\18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7bN.exe

Filesize
564KB

MD5
31e2c53b5bf4d2dbb52412efbfc8bf00

SHA1
4cd7735b817535352add043aae894473976af918

SHA256
18d6cb03aaa51e60509d37c28b01d36cfb9dc27cbf3824a194096756a779cf7b

SHA512
76acdfab2ff25ec3d52ab30357c55d35977af12057363638e1da614dc8584c4282482e7bad37620894c4349ef921947f34fb44b53531b5c5deea57aa1056ca76

Download Submit
memory/2696-20-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download
memory/2696-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2696-45-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download
memory/2696-44-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download
memory/2696-9-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2696-7-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2696-19-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2696-17-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2696-15-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2696-11-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2696-12-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2956-3-0x0000000000680000-0x000000000069E000-memory.dmp

Filesize
120KB

Download
memory/2956-6-0x0000000000380000-0x00000000003D0000-memory.dmp

Filesize
320KB

Download
memory/2956-0-0x000000007428E000-0x000000007428F000-memory.dmp

Filesize
4KB

Download
memory/2956-21-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download
memory/2956-2-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download
memory/2956-1-0x00000000000C0000-0x0000000000150000-memory.dmp

Filesize
576KB

Download
memory/2956-5-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download
memory/2956-4-0x000000007428E000-0x000000007428F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing