xworm | eacc39dac1d60cdb6d602775a25cd954bf52c3379d1c2b588a2692705db84004

General

Target

eacc39dac1d60cdb6d602775a25cd954bf52c3379d1c2b588a2692705db84004N.exe
Size

369KB
MD5

cddbe369e9f8f31485f9cf74aa0171a0
SHA1

82c0b7ac4d86f0c2f484e05d40c62c00aba6fa20
SHA256

eacc39dac1d60cdb6d602775a25cd954bf52c3379d1c2b588a2692705db84004
SHA512

35272cdba5aea95fe4cf95a8aea367b1389c7d44cd0131cdad62b10133076b25b6d05ed34c400a89b988f6d2a964ace70fe87d31c0ff8f2abbbf8d72437f7a66
SSDEEP

6144:ctp5GoZ7+VAtqw7S0R7E9Ou8Vp6Ozb784gO:ctpHSSZb7E96VpaO

Score

10^/10

xworm discovery rat trojan

Malware Config

Extracted

Family

xworm

C2

recommended-pad.gl.at.ply.gg:63567

Attributes

Install_directory
%AppData%
install_file
Discord.exe

Signatures

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral1/memory/2544-1-0x0000000000AE0000-0x0000000000B44000-memory.dmp	family_xworm
behavioral1/files/0x0008000000016da7-12.dat	family_xworm
behavioral1/memory/2500-15-0x00000000001E0000-0x00000000001FA000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Executes dropped EXE 2 IoCs

pid	Process
2320	svchost.exe
2500	explorer.exe

Loads dropped DLL 3 IoCs

pid	Process
2544	eacc39dac1d60cdb6d602775a25cd954bf52c3379d1c2b588a2692705db84004N.exe
2060	Process not Found
2544	eacc39dac1d60cdb6d602775a25cd954bf52c3379d1c2b588a2692705db84004N.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eacc39dac1d60cdb6d602775a25cd954bf52c3379d1c2b588a2692705db84004N.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2500	explorer.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2320	2544	eacc39dac1d60cdb6d602775a25cd954bf52c3379d1c2b588a2692705db84004N.exe	31
PID 2544 wrote to memory of 2320	2544	eacc39dac1d60cdb6d602775a25cd954bf52c3379d1c2b588a2692705db84004N.exe	31
PID 2544 wrote to memory of 2320	2544	eacc39dac1d60cdb6d602775a25cd954bf52c3379d1c2b588a2692705db84004N.exe	31
PID 2544 wrote to memory of 2320	2544	eacc39dac1d60cdb6d602775a25cd954bf52c3379d1c2b588a2692705db84004N.exe	31
PID 2544 wrote to memory of 2500	2544	eacc39dac1d60cdb6d602775a25cd954bf52c3379d1c2b588a2692705db84004N.exe	33
PID 2544 wrote to memory of 2500	2544	eacc39dac1d60cdb6d602775a25cd954bf52c3379d1c2b588a2692705db84004N.exe	33
PID 2544 wrote to memory of 2500	2544	eacc39dac1d60cdb6d602775a25cd954bf52c3379d1c2b588a2692705db84004N.exe	33
PID 2544 wrote to memory of 2500	2544	eacc39dac1d60cdb6d602775a25cd954bf52c3379d1c2b588a2692705db84004N.exe	33

C:\Users\Admin\AppData\Local\Temp\eacc39dac1d60cdb6d602775a25cd954bf52c3379d1c2b588a2692705db84004N.exe
"C:\Users\Admin\AppData\Local\Temp\eacc39dac1d60cdb6d602775a25cd954bf52c3379d1c2b588a2692705db84004N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Users\Admin\AppData\Local\Temp\explorer.exe
  "C:\Users\Admin\AppData\Local\Temp\explorer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\explorer.exe

Filesize
76KB

MD5
b14932410b74d37c4911f573f5d063d1

SHA1
f32b39f0c43bc00d580c5f306757f668b3355bff

SHA256
0dc0c81f376cdd8e3b0499f5676dffd9d10500514a1e3c6fc9296ee762cb2b0c

SHA512
3a02fffe70177ae84e83243fe86fa7acd9d3304525ad7d6072e8ed895fb8b463154291738f5d3d18edadd3e41874dbead6c69cbf46fa9cf4d0aaa92b0544cf22

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
234KB

MD5
8c624e64742bc19447d52f61edec52db

SHA1
1e700e2dd61b5d566a651433dc86bd95a6d54449

SHA256
13fd7a9c6f7c98239a61a212f69211a0f19159b2e8cdae8b1efc57d35cdcd5ad

SHA512
f676f7aa863fd13494186d4be597c19e49dc8245f6a98a2e9e2f1d09aa9e4cbf7a87c552e49359347b24b46cd1eddfb6edcfcbd6f4ff4d24888831ff182c952a

Download Submit
memory/2500-14-0x000007FEF52A3000-0x000007FEF52A4000-memory.dmp

Filesize
4KB

Download
memory/2500-15-0x00000000001E0000-0x00000000001FA000-memory.dmp

Filesize
104KB

Download
memory/2500-16-0x000007FEF52A0000-0x000007FEF5C8C000-memory.dmp

Filesize
9.9MB

Download
memory/2500-17-0x000007FEF52A3000-0x000007FEF52A4000-memory.dmp

Filesize
4KB

Download
memory/2500-18-0x000007FEF52A0000-0x000007FEF5C8C000-memory.dmp

Filesize
9.9MB

Download
memory/2544-0-0x00000000740FE000-0x00000000740FF000-memory.dmp

Filesize
4KB

Download
memory/2544-1-0x0000000000AE0000-0x0000000000B44000-memory.dmp

Filesize
400KB

Download

Analysis

Sharing