xworm | eacc39dac1d60cdb6d602775a25cd954bf52c3379d1c2b588a2692705db84004

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2024 15:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eacc39dac1d60cdb6d602775a25cd954bf52c3379d1c2b588a2692705db84004N.exe
Size

369KB
MD5

cddbe369e9f8f31485f9cf74aa0171a0
SHA1

82c0b7ac4d86f0c2f484e05d40c62c00aba6fa20
SHA256

eacc39dac1d60cdb6d602775a25cd954bf52c3379d1c2b588a2692705db84004
SHA512

35272cdba5aea95fe4cf95a8aea367b1389c7d44cd0131cdad62b10133076b25b6d05ed34c400a89b988f6d2a964ace70fe87d31c0ff8f2abbbf8d72437f7a66
SSDEEP

6144:ctp5GoZ7+VAtqw7S0R7E9Ou8Vp6Ozb784gO:ctpHSSZb7E96VpaO

Score

10^/10

xworm discovery rat trojan

Malware Config

Extracted

Family

xworm

recommended-pad.gl.at.ply.gg:63567

Attributes

Install_directory
%AppData%
install_file
Discord.exe

Signatures

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral2/memory/4684-1-0x0000000000EC0000-0x0000000000F24000-memory.dmp	family_xworm
behavioral2/files/0x000b000000023b84-14.dat	family_xworm
behavioral2/memory/2764-23-0x0000000000290000-0x00000000002AA000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	eacc39dac1d60cdb6d602775a25cd954bf52c3379d1c2b588a2692705db84004N.exe

Executes dropped EXE 2 IoCs

pid	Process
4420	svchost.exe
2764	explorer.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eacc39dac1d60cdb6d602775a25cd954bf52c3379d1c2b588a2692705db84004N.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2764	explorer.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 4420	4684	eacc39dac1d60cdb6d602775a25cd954bf52c3379d1c2b588a2692705db84004N.exe	86
PID 4684 wrote to memory of 4420	4684	eacc39dac1d60cdb6d602775a25cd954bf52c3379d1c2b588a2692705db84004N.exe	86
PID 4684 wrote to memory of 2764	4684	eacc39dac1d60cdb6d602775a25cd954bf52c3379d1c2b588a2692705db84004N.exe	88
PID 4684 wrote to memory of 2764	4684	eacc39dac1d60cdb6d602775a25cd954bf52c3379d1c2b588a2692705db84004N.exe	88

C:\Users\Admin\AppData\Local\Temp\eacc39dac1d60cdb6d602775a25cd954bf52c3379d1c2b588a2692705db84004N.exe
"C:\Users\Admin\AppData\Local\Temp\eacc39dac1d60cdb6d602775a25cd954bf52c3379d1c2b588a2692705db84004N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Users\Admin\AppData\Local\Temp\explorer.exe
  "C:\Users\Admin\AppData\Local\Temp\explorer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\explorer.exe

Filesize
76KB

MD5
b14932410b74d37c4911f573f5d063d1

SHA1
f32b39f0c43bc00d580c5f306757f668b3355bff

SHA256
0dc0c81f376cdd8e3b0499f5676dffd9d10500514a1e3c6fc9296ee762cb2b0c

SHA512
3a02fffe70177ae84e83243fe86fa7acd9d3304525ad7d6072e8ed895fb8b463154291738f5d3d18edadd3e41874dbead6c69cbf46fa9cf4d0aaa92b0544cf22

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
234KB

MD5
8c624e64742bc19447d52f61edec52db

SHA1
1e700e2dd61b5d566a651433dc86bd95a6d54449

SHA256
13fd7a9c6f7c98239a61a212f69211a0f19159b2e8cdae8b1efc57d35cdcd5ad

SHA512
f676f7aa863fd13494186d4be597c19e49dc8245f6a98a2e9e2f1d09aa9e4cbf7a87c552e49359347b24b46cd1eddfb6edcfcbd6f4ff4d24888831ff182c952a

Download Submit
memory/2764-21-0x00007FFA89BB3000-0x00007FFA89BB5000-memory.dmp

Filesize
8KB

Download
memory/2764-23-0x0000000000290000-0x00000000002AA000-memory.dmp

Filesize
104KB

Download
memory/2764-24-0x00007FFA89BB0000-0x00007FFA8A671000-memory.dmp

Filesize
10.8MB

Download
memory/2764-25-0x00007FFA89BB0000-0x00007FFA8A671000-memory.dmp

Filesize
10.8MB

Download
memory/4684-0-0x0000000074DBE000-0x0000000074DBF000-memory.dmp

Filesize
4KB

Download
memory/4684-1-0x0000000000EC0000-0x0000000000F24000-memory.dmp

Filesize
400KB

Download
memory/4684-2-0x00000000058E0000-0x000000000597C000-memory.dmp

Filesize
624KB

Download