xworm | ca499aa6e07866d66b5a5c094b183e81bc56d92a6caaf202da6c520437c93cc8

General

Target

ca499aa6e07866d66b5a5c094b183e81bc56d92a6caaf202da6c520437c93cc8.exe
Size

58KB
MD5

469b78eefebb0c3f12c842b4f323de93
SHA1

a54fc77abf4dae800de294f2431cf5150d01e877
SHA256

ca499aa6e07866d66b5a5c094b183e81bc56d92a6caaf202da6c520437c93cc8
SHA512

45f98e88285f4f6b5cc1bb696110499c54db6a0ac58b0c33c9c90fe4c66009b8fec71711371e80db532183a6dec416787e84ee0b26f9017d8b41fee2b803cdd6
SSDEEP

768:x7MZ4sXKZQmh8kx7j8WjS51zgLF4fg7tr8K/YoCrjq0KQXdNsOPAufXZjfrC/1UQ:fsdmh8K7jrO5d2gRpKWNtP3/ZjzvD

Score

10^/10

xworm discovery rat trojan

Malware Config

Extracted

Family

xworm

C2

materials-defects.gl.at.ply.gg:39616

Mutex

rIuGGTci5WjqsMOs

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023c77-44.dat	family_xworm
behavioral2/memory/3236-100-0x0000000000FF0000-0x0000000000FFE000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	ca499aa6e07866d66b5a5c094b183e81bc56d92a6caaf202da6c520437c93cc8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	DoDo.exe

Executes dropped EXE 2 IoCs

pid	Process
4640	DoDo.exe
3236	Anti-Cheat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DoDo.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ca499aa6e07866d66b5a5c094b183e81bc56d92a6caaf202da6c520437c93cc8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	DoDo.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3236	Anti-Cheat.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 4640	2880	ca499aa6e07866d66b5a5c094b183e81bc56d92a6caaf202da6c520437c93cc8.exe	84
PID 2880 wrote to memory of 4640	2880	ca499aa6e07866d66b5a5c094b183e81bc56d92a6caaf202da6c520437c93cc8.exe	84
PID 2880 wrote to memory of 4640	2880	ca499aa6e07866d66b5a5c094b183e81bc56d92a6caaf202da6c520437c93cc8.exe	84
PID 4640 wrote to memory of 3236	4640	DoDo.exe	88
PID 4640 wrote to memory of 3236	4640	DoDo.exe	88

C:\Users\Admin\AppData\Local\Temp\ca499aa6e07866d66b5a5c094b183e81bc56d92a6caaf202da6c520437c93cc8.exe
"C:\Users\Admin\AppData\Local\Temp\ca499aa6e07866d66b5a5c094b183e81bc56d92a6caaf202da6c520437c93cc8.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Users\Admin\AppData\Local\Temp\DoDo.exe
  "C:\Users\Admin\AppData\Local\Temp\DoDo.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Users\Admin\AppData\Local\Temp\Anti-Cheat.exe
    "C:\Users\Admin\AppData\Local\Temp\Anti-Cheat.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Anti-Cheat.exe

Filesize
34KB

MD5
aa696f79e5297b2cd9c183df3339356c

SHA1
37c398ecb1fcb43e92afdc938ac6e9ded7bd3f75

SHA256
999af7fc70df1052507ee82bfd0dab9fda53c455d7cd9f0f876b67579393617a

SHA512
82607232e31d69ee70617705fdfa0169d1beccf90064839023b4a9fa8f4d253494f6da15b304ce96aacfd044cf2930851de9548a4066a67c32452bc1c73c2247

Download Submit
C:\Users\Admin\AppData\Local\Temp\DoDo.exe

Filesize
32KB

MD5
00e8b4319100ee1fdd88d6b75a269e5c

SHA1
ef2e2e5b1cd6111a7872e6228a5731e7a1f2e305

SHA256
0ad5ae166692a36534fbdd33615425f21efa6aeeb6ab8132435c86e3d4527653

SHA512
0750f69a1f73e9ff7767c41196b88ed3a6a70f6fff3e7bb7372580f6998d0f6fe32874e46486ed17a26794cedd1751179194d5197321b83fa9d7ee3f111c8d02

Download Submit
memory/2880-0-0x00007FF9DFD73000-0x00007FF9DFD75000-memory.dmp

Filesize
8KB

Download
memory/2880-1-0x00000000008F0000-0x0000000000902000-memory.dmp

Filesize
72KB

Download
memory/2880-2-0x00000000012B0000-0x00000000012BE000-memory.dmp

Filesize
56KB

Download
memory/2880-29-0x00007FF9DFD70000-0x00007FF9E0831000-memory.dmp

Filesize
10.8MB

Download
memory/2880-38-0x00007FF9DFD70000-0x00007FF9E0831000-memory.dmp

Filesize
10.8MB

Download
memory/3236-100-0x0000000000FF0000-0x0000000000FFE000-memory.dmp

Filesize
56KB

Download
memory/4640-39-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing