xworm | dedd4c249a6a78e8e2603e7bf8227bbcd1dcca0e0f272ec204cf4a1a61dae7d9

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2024, 15:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FullOption_2.1Xenos.exe
Size

4.0MB
MD5

c442a9b9299246b2e5683641a4341641
SHA1

31f41c27ceacc503f33ea72c1ac7c077bc5d9235
SHA256

dedd4c249a6a78e8e2603e7bf8227bbcd1dcca0e0f272ec204cf4a1a61dae7d9
SHA512

fc605adcf43c6f4ae4b4903cf1ba43bc447ddecbbaa8e412845b0ddfee4b36be55e32b42b3005c7c67bb59f5f2a4c9271baa97eb497c4998883f7e69ec8bdd36
SSDEEP

98304:mer3mJdJ0Gz+yQ3zkgHC3lD1qhPEeXkZGRaGxOJx1/q:jSJdJrz+yOkg8BQPfXYoI1

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

45.141.27.248:7777

Attributes

Install_directory
%ProgramData%
install_file
svchost.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023c14-20.dat	family_xworm
behavioral2/memory/1936-22-0x0000000000F10000-0x0000000000F28000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	FullOption_2.1Xenos.exe

Executes dropped EXE 2 IoCs

pid	Process
3360	FullOption_2.1Xenos.exe
1936	svchost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1936	svchost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 3360	2176	FullOption_2.1Xenos.exe	83
PID 2176 wrote to memory of 3360	2176	FullOption_2.1Xenos.exe	83
PID 2176 wrote to memory of 1936	2176	FullOption_2.1Xenos.exe	84
PID 2176 wrote to memory of 1936	2176	FullOption_2.1Xenos.exe	84

C:\Users\Admin\AppData\Local\Temp\FullOption_2.1Xenos.exe
"C:\Users\Admin\AppData\Local\Temp\FullOption_2.1Xenos.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Users\Admin\AppData\Roaming\FullOption_2.1Xenos.exe
  "C:\Users\Admin\AppData\Roaming\FullOption_2.1Xenos.exe"
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\FullOption_2.1Xenos.exe

Filesize
3.9MB

MD5
2f6e9c0dd1c6859a9d6e7acea1db9ac0

SHA1
b0dcd2be62b6a559e479de7745ab0988b8b30522

SHA256
122e3cb0f2ad233d1a364911d433667e7778f00d9a7d10b954c994f4e8093d1f

SHA512
fe3634f46afd5b45f0ffc721a18b5ef1b1344b548f90b8c54ea6995e3d64b7394b56c681b1a0522b67e862fce9d8333b621612a2f03708e7dbc917a28c58c15d

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
73KB

MD5
12b722899c9a6b517d52b8de2c7c3e2e

SHA1
a92dbc8edd02adeeab5fa9c0e2a884a84a315fe5

SHA256
57ec7bca087dd678bef5aeaaa52f4f393d63613976701e6a111015fb7f9f1b6c

SHA512
f7b56b96a2dcda223668d82bc8dd7c5a0e7e5786aacad6a0bec809e8525e383b9a85f9e834cf29636fcdb84cce97cf4ad996f9d2cc827c189a2c06baec661a53

Download Submit
memory/1936-22-0x0000000000F10000-0x0000000000F28000-memory.dmp

Filesize
96KB

Download
memory/1936-23-0x00007FFF30AC0000-0x00007FFF31581000-memory.dmp

Filesize
10.8MB

Download
memory/1936-24-0x00007FFF30AC0000-0x00007FFF31581000-memory.dmp

Filesize
10.8MB

Download
memory/2176-0-0x00007FFF30AC3000-0x00007FFF30AC5000-memory.dmp

Filesize
8KB

Download
memory/2176-1-0x00000000008A0000-0x0000000000C9E000-memory.dmp

Filesize
4.0MB

Download