xworm | b4bbc1012005092e6733ebfafbf36ecf7299a5daae8efd47c15e0269ba5581d1

General

Target

b4bbc1012005092e6733ebfafbf36ecf7299a5daae8efd47c15e0269ba5581d1N.exe
Size

39KB
MD5

e3d6d70964cb1dee7c881ecc2392c6e0
SHA1

36c95f2fb67280ade55d5e5a210f8f0048fcfcba
SHA256

b4bbc1012005092e6733ebfafbf36ecf7299a5daae8efd47c15e0269ba5581d1
SHA512

7c71c695c17656a807129e9cc31c32cead584c480fb5e8b699f564a3beaf1adf11b194dcff3fb2eb249edf5754d35c03a5a52e3e0fb24d0aef6ea26f71a53485
SSDEEP

768:oHy/gfUevnMshwZM5EIDPiKuukR7LKtTfFWPt9e96cOMheadw:oHyCNv9hC8EIbiKuumnSFe9e96cOM07

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

voice-engaged.gl.at.ply.gg:48359

Mutex

f3eBZMe3wcJmG6S2

Attributes

Install_directory
%Temp%
install_file
svchost.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2492-1-0x0000000000100000-0x0000000000110000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1696	powershell.exe
2180	powershell.exe
2660	powershell.exe
2708	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	b4bbc1012005092e6733ebfafbf36ecf7299a5daae8efd47c15e0269ba5581d1N.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	b4bbc1012005092e6733ebfafbf36ecf7299a5daae8efd47c15e0269ba5581d1N.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe"	b4bbc1012005092e6733ebfafbf36ecf7299a5daae8efd47c15e0269ba5581d1N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2180	powershell.exe
2660	powershell.exe
2708	powershell.exe
1696	powershell.exe
2492	b4bbc1012005092e6733ebfafbf36ecf7299a5daae8efd47c15e0269ba5581d1N.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2492	b4bbc1012005092e6733ebfafbf36ecf7299a5daae8efd47c15e0269ba5581d1N.exe
Token: SeDebugPrivilege	2180	powershell.exe
Token: SeDebugPrivilege	2660	powershell.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	1696	powershell.exe
Token: SeDebugPrivilege	2492	b4bbc1012005092e6733ebfafbf36ecf7299a5daae8efd47c15e0269ba5581d1N.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2492	b4bbc1012005092e6733ebfafbf36ecf7299a5daae8efd47c15e0269ba5581d1N.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2180	2492	b4bbc1012005092e6733ebfafbf36ecf7299a5daae8efd47c15e0269ba5581d1N.exe	30
PID 2492 wrote to memory of 2180	2492	b4bbc1012005092e6733ebfafbf36ecf7299a5daae8efd47c15e0269ba5581d1N.exe	30
PID 2492 wrote to memory of 2180	2492	b4bbc1012005092e6733ebfafbf36ecf7299a5daae8efd47c15e0269ba5581d1N.exe	30
PID 2492 wrote to memory of 2660	2492	b4bbc1012005092e6733ebfafbf36ecf7299a5daae8efd47c15e0269ba5581d1N.exe	32
PID 2492 wrote to memory of 2660	2492	b4bbc1012005092e6733ebfafbf36ecf7299a5daae8efd47c15e0269ba5581d1N.exe	32
PID 2492 wrote to memory of 2660	2492	b4bbc1012005092e6733ebfafbf36ecf7299a5daae8efd47c15e0269ba5581d1N.exe	32
PID 2492 wrote to memory of 2708	2492	b4bbc1012005092e6733ebfafbf36ecf7299a5daae8efd47c15e0269ba5581d1N.exe	34
PID 2492 wrote to memory of 2708	2492	b4bbc1012005092e6733ebfafbf36ecf7299a5daae8efd47c15e0269ba5581d1N.exe	34
PID 2492 wrote to memory of 2708	2492	b4bbc1012005092e6733ebfafbf36ecf7299a5daae8efd47c15e0269ba5581d1N.exe	34
PID 2492 wrote to memory of 1696	2492	b4bbc1012005092e6733ebfafbf36ecf7299a5daae8efd47c15e0269ba5581d1N.exe	36
PID 2492 wrote to memory of 1696	2492	b4bbc1012005092e6733ebfafbf36ecf7299a5daae8efd47c15e0269ba5581d1N.exe	36
PID 2492 wrote to memory of 1696	2492	b4bbc1012005092e6733ebfafbf36ecf7299a5daae8efd47c15e0269ba5581d1N.exe	36

C:\Users\Admin\AppData\Local\Temp\b4bbc1012005092e6733ebfafbf36ecf7299a5daae8efd47c15e0269ba5581d1N.exe
"C:\Users\Admin\AppData\Local\Temp\b4bbc1012005092e6733ebfafbf36ecf7299a5daae8efd47c15e0269ba5581d1N.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\b4bbc1012005092e6733ebfafbf36ecf7299a5daae8efd47c15e0269ba5581d1N.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'b4bbc1012005092e6733ebfafbf36ecf7299a5daae8efd47c15e0269ba5581d1N.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\W7STNE5FL2XUHOTFXI2C.temp

Filesize
7KB

MD5
1f23af7e2f33c12947eb305bc52d94af

SHA1
6ab237c6a63948fa4eb786f76cc79d5e16d2454b

SHA256
d9da8825a632bbe11d0fa887401aaf015b3ee459f576efa27746b22c3ac74f04

SHA512
9b475dfbc36b263402d67b1cd029fdcd9e70d74723afc7e35de34287d33d8bde617ce785d7f0977972909ea547cda809911862477467c3cca0bfcadeecc49e2e

Download Submit
memory/2180-6-0x00000000029C0000-0x0000000002A40000-memory.dmp

Filesize
512KB

Download
memory/2180-7-0x000000001B380000-0x000000001B662000-memory.dmp

Filesize
2.9MB

Download
memory/2180-8-0x00000000022A0000-0x00000000022A8000-memory.dmp

Filesize
32KB

Download
memory/2492-1-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/2492-0-0x000007FEF6503000-0x000007FEF6504000-memory.dmp

Filesize
4KB

Download
memory/2492-27-0x000007FEF6503000-0x000007FEF6504000-memory.dmp

Filesize
4KB

Download
memory/2492-32-0x000000001B120000-0x000000001B1A0000-memory.dmp

Filesize
512KB

Download
memory/2492-33-0x000000001B120000-0x000000001B1A0000-memory.dmp

Filesize
512KB

Download
memory/2660-14-0x000000001B3A0000-0x000000001B682000-memory.dmp

Filesize
2.9MB

Download
memory/2660-15-0x0000000002490000-0x0000000002498000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads