xworm | 8ec295982ca22a14ca3098eaba0ad73948c7e546d738e838244e01f4af57673a

Analysis

max time kernel
94s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2024 20:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TalibanStealerInstaller.exe
Size

4.1MB
MD5

7531fbb7431039bda2b19160e0b9c2d4
SHA1

b7f4a971ebf8128ee1ea7cb764b9582fb73b8002
SHA256

6a93c6b6467f2e24918f9c39f2b0d91a14974b3af096d39dda126c02f3299bc8
SHA512

5b8b09d896e12f3da879939f3c925da58ba79c6c1f2559594b1eb11d8fd5f63d3afeb12484b8656e0ba929cb0bb7fbb67a566d3599769c955885ca21b4036487
SSDEEP

98304:51mCYY8UGo4x83fa1lyrd3qNz6VTDwgiLC/sE1:nmCWUUqi1s530+VohE

Score

10^/10

xworm defense_evasion discovery rat trojan

Malware Config

Extracted

Family

xworm

lijaligibidu-35558.portmap.host:35558

Attributes

Install_directory
%AppData%
install_file
Windows Security.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023c8e-13.dat	family_xworm
behavioral2/memory/212-22-0x00000000009B0000-0x00000000009C8000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	TalibanStealerInstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	TalibanStealerInstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Windows Security.exe

Executes dropped EXE 5 IoCs

pid	Process
440	TalibanStealerInstaller.exe
212	WindowsSecurity.exe
556	Windows Security.exe
4644	TalibanStealerInstaller.exe
4676	c9IDU7463.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows Security.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TalibanStealerInstaller.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2136	powershell.exe
4420	powershell.exe
2136	powershell.exe
4420	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	212	WindowsSecurity.exe
Token: SeDebugPrivilege	4676	c9IDU7463.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeDebugPrivilege	4420	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 440	3872	TalibanStealerInstaller.exe	84
PID 3872 wrote to memory of 440	3872	TalibanStealerInstaller.exe	84
PID 3872 wrote to memory of 440	3872	TalibanStealerInstaller.exe	84
PID 3872 wrote to memory of 212	3872	TalibanStealerInstaller.exe	85
PID 3872 wrote to memory of 212	3872	TalibanStealerInstaller.exe	85
PID 440 wrote to memory of 2136	440	TalibanStealerInstaller.exe	88
PID 440 wrote to memory of 2136	440	TalibanStealerInstaller.exe	88
PID 440 wrote to memory of 2136	440	TalibanStealerInstaller.exe	88
PID 440 wrote to memory of 556	440	TalibanStealerInstaller.exe	90
PID 440 wrote to memory of 556	440	TalibanStealerInstaller.exe	90
PID 440 wrote to memory of 556	440	TalibanStealerInstaller.exe	90
PID 440 wrote to memory of 4644	440	TalibanStealerInstaller.exe	91
PID 440 wrote to memory of 4644	440	TalibanStealerInstaller.exe	91
PID 556 wrote to memory of 4420	556	Windows Security.exe	92
PID 556 wrote to memory of 4420	556	Windows Security.exe	92
PID 556 wrote to memory of 4420	556	Windows Security.exe	92
PID 556 wrote to memory of 4676	556	Windows Security.exe	94
PID 556 wrote to memory of 4676	556	Windows Security.exe	94

C:\Users\Admin\AppData\Local\Temp\TalibanStealerInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\TalibanStealerInstaller.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Users\Admin\AppData\Roaming\TalibanStealerInstaller.exe
  "C:\Users\Admin\AppData\Roaming\TalibanStealerInstaller.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:440
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAdAByACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHoAYwBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGsAdwBuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGsAdgBjACMAPgA="
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2136
- - C:\Users\Admin\AppData\Local\Temp\Windows Security.exe
    "C:\Users\Admin\AppData\Local\Temp\Windows Security.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:556
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHcAbQBrACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHEAYwB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGoAZgBmACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAdwBiACMAPgA="
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\c9IDU7463.exe
      "C:\Users\Admin\AppData\Local\Temp\c9IDU7463.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4676
- - C:\Users\Admin\AppData\Local\Temp\TalibanStealerInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\TalibanStealerInstaller.exe"
    3⤵
    - Executes dropped EXE
    PID:4644
- C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe
  "C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\TalibanStealerInstaller.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
cfaac099faa4f0fb899d2a76f99cbcd8

SHA1
76c3f39fd29986ae510b8d0f69550247371236c9

SHA256
81b59bdb9e991889baab741d8edfd11f34314f52524263a0cc7609330ba9025c

SHA512
65f2fbd0a4599ecd278096a612ba2f540ffb3275db1340f2736e3fc65f789a538a7633fe3bf6bdfd5b45285d079cbfe0006b3e9e0a8927512b4da1a1f379c99b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TalibanStealerInstaller.exe

Filesize
2.5MB

MD5
cdfcc41584dcd2a57da70353cb9955a8

SHA1
78b0a8cda3187d7ba842c9148446da5c628370b5

SHA256
be453771400d21a320f759b3b99bd7cf07d9d8301db6bce115bafae1aff79fb3

SHA512
4db311aac921a20b9be5c28e66b54912065ac5aeb56b45c20fe7383ff69aa50622e6da383f029a6291525457439cd2e6ac403860af4d82bd61a86df3aad9e7dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows Security.exe

Filesize
1018KB

MD5
d8cdeec022d5fda0ab78a7ecc9efa3ae

SHA1
3cb31d1646d3f63019a0c3745d3f2c62bdaab243

SHA256
e5b7e580db8476b8e4d2ae806288984df4eb0c5a061bed61c77157a2628ae1ea

SHA512
4ddd191a8c352cef83ba3dee0a2ba15fcd95c397fc13af152c2ef9731ec66c7ee332c8079567ee03e77a38225a8453aee798f573d25c35cb98921d09597ed63e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uynygtiv.k0i.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\c9IDU7463.exe

Filesize
971KB

MD5
26efc684ddd0782b295a6ee4a76e3256

SHA1
08cc73ef5c1b02e09765181a5acee1a7018dcffc

SHA256
bf832f28b8d9f2ff077f691bd7e8a2cf46f3a4ac0ee8ee2d2f2944089abd20ab

SHA512
20ba9e73514148613943db974cf88874907f9fe19e1cf5d81d9bf83ffbd233be80e925c62a5430a7ef69099e603ae54d60680020e0de58e632897f8c4aecfb49

Download Submit
C:\Users\Admin\AppData\Roaming\TalibanStealerInstaller.exe

Filesize
3.7MB

MD5
0bd9c3971db333e1ccc5c327c4b06baa

SHA1
2e319ceb3f8fd1cd61d5e40002e493117ed9321d

SHA256
651b7894bf375daa0ec4d1fe71ba43f5fd3fcf62363d4141a767f7c8abedb216

SHA512
997b7356d55218f72e289b95b6170fb7c8998a2caedc19614d118f6566453301403339a3db6a0a9b8b9d73feb17947661571040a458e938c7db649b637bb39bb

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe

Filesize
75KB

MD5
cf219a189dae4a022f26dd58cd5367e6

SHA1
76c2e7b756e894afc4e5fd7267fce398d58c518f

SHA256
725c0bcdb953e39e96a0192d2712b261541647259e494c583d19697a10d2ffbe

SHA512
21dc7cdd5ea07be708a5c696708207a1760851d2fbb608969254a8f3e806bbb87b6b27a4d5f4cecf1b5d90f6fc81759fd9f6222ddafdb955d41b0333ea085f1f

Download Submit
memory/212-23-0x00007FFA102C0000-0x00007FFA10D81000-memory.dmp

Filesize
10.8MB

Download
memory/212-22-0x00000000009B0000-0x00000000009C8000-memory.dmp

Filesize
96KB

Download
memory/212-120-0x00007FFA102C0000-0x00007FFA10D81000-memory.dmp

Filesize
10.8MB

Download
memory/212-108-0x00007FFA102C0000-0x00007FFA10D81000-memory.dmp

Filesize
10.8MB

Download
memory/2136-109-0x0000000007380000-0x00000000079FA000-memory.dmp

Filesize
6.5MB

Download
memory/2136-84-0x0000000005AE0000-0x0000000005B2C000-memory.dmp

Filesize
304KB

Download
memory/2136-111-0x0000000006DC0000-0x0000000006DCA000-memory.dmp

Filesize
40KB

Download
memory/2136-62-0x0000000005370000-0x00000000053D6000-memory.dmp

Filesize
408KB

Download
memory/2136-63-0x00000000053E0000-0x0000000005446000-memory.dmp

Filesize
408KB

Download
memory/2136-61-0x0000000004A50000-0x0000000004A72000-memory.dmp

Filesize
136KB

Download
memory/2136-69-0x0000000005450000-0x00000000057A4000-memory.dmp

Filesize
3.3MB

Download
memory/2136-117-0x0000000007080000-0x0000000007088000-memory.dmp

Filesize
32KB

Download
memory/2136-83-0x0000000005A10000-0x0000000005A2E000-memory.dmp

Filesize
120KB

Download
memory/2136-56-0x0000000004CD0000-0x00000000052F8000-memory.dmp

Filesize
6.2MB

Download
memory/2136-86-0x00000000748D0000-0x000000007491C000-memory.dmp

Filesize
304KB

Download
memory/2136-97-0x0000000006C00000-0x0000000006CA3000-memory.dmp

Filesize
652KB

Download
memory/2136-96-0x0000000006B80000-0x0000000006B9E000-memory.dmp

Filesize
120KB

Download
memory/2136-85-0x0000000006BC0000-0x0000000006BF2000-memory.dmp

Filesize
200KB

Download
memory/2136-113-0x0000000006F40000-0x0000000006F51000-memory.dmp

Filesize
68KB

Download
memory/2136-46-0x00000000020F0000-0x0000000002126000-memory.dmp

Filesize
216KB

Download
memory/2136-110-0x0000000006D40000-0x0000000006D5A000-memory.dmp

Filesize
104KB

Download
memory/3872-0-0x00007FFA102C3000-0x00007FFA102C5000-memory.dmp

Filesize
8KB

Download
memory/3872-1-0x0000000000200000-0x0000000000614000-memory.dmp

Filesize
4.1MB

Download
memory/4420-112-0x00000000077C0000-0x0000000007856000-memory.dmp

Filesize
600KB

Download
memory/4420-98-0x00000000748D0000-0x000000007491C000-memory.dmp

Filesize
304KB

Download
memory/4420-114-0x0000000007770000-0x000000000777E000-memory.dmp

Filesize
56KB

Download
memory/4420-115-0x0000000007780000-0x0000000007794000-memory.dmp

Filesize
80KB

Download
memory/4420-116-0x0000000007880000-0x000000000789A000-memory.dmp

Filesize
104KB

Download
memory/4644-47-0x00000155A48B0000-0x00000155A48C4000-memory.dmp

Filesize
80KB

Download
memory/4644-45-0x00000155BD190000-0x00000155BD2DE000-memory.dmp

Filesize
1.3MB

Download
memory/4644-44-0x00000155A2AD0000-0x00000155A2D4E000-memory.dmp

Filesize
2.5MB

Download
memory/4676-60-0x0000000000220000-0x000000000031A000-memory.dmp

Filesize
1000KB

Download