xworm | be69709414e60eae521dc4b85784bceda124959adc21b554aaa660707dbbe89c

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-11-2024 03:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be69709414e60eae521dc4b85784bceda124959adc21b554aaa660707dbbe89c.exe
Size

2.4MB
MD5

bdc6432b365c256c5d0efe8d66122e8f
SHA1

1ca7dda606a3b2204f35e43abb68b04c97063d36
SHA256

be69709414e60eae521dc4b85784bceda124959adc21b554aaa660707dbbe89c
SHA512

3d28acbe162b0d88f1b3ca8a034c010a973ccc05ff3f0f0a9dbb902f98924cae1bce5f1b9f20f58567669503c41e9696000fb27edda4416398f0e7aac525b767
SSDEEP

49152:+2uqU+xRoatgQBJKweR4RF8gAGBJ7dj9Shv68pd3hm/F4OGP6:+2uOxRoaOQBEws4gWrhcoq3HOz

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

93.123.109.89:7000

Attributes

Install_directory
%Temp%
install_file
ApplicationFrameHost.exe
telegram
https://api.telegram.org/bot7026989332:AAGmlQvBZEqqtR_5LGfdSJ8B_oJ6WH5oCYY

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023ca3-19.dat	family_xworm
behavioral2/memory/3952-22-0x00000000003C0000-0x00000000003D8000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	be69709414e60eae521dc4b85784bceda124959adc21b554aaa660707dbbe89c.exe

Executes dropped EXE 2 IoCs

pid	Process
1704	Ocean.exe
3952	ApplicationFrameHost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1704	Ocean.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3952	ApplicationFrameHost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1704	Ocean.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 1704	2076	be69709414e60eae521dc4b85784bceda124959adc21b554aaa660707dbbe89c.exe	84
PID 2076 wrote to memory of 1704	2076	be69709414e60eae521dc4b85784bceda124959adc21b554aaa660707dbbe89c.exe	84
PID 2076 wrote to memory of 3952	2076	be69709414e60eae521dc4b85784bceda124959adc21b554aaa660707dbbe89c.exe	85
PID 2076 wrote to memory of 3952	2076	be69709414e60eae521dc4b85784bceda124959adc21b554aaa660707dbbe89c.exe	85

C:\Users\Admin\AppData\Local\Temp\be69709414e60eae521dc4b85784bceda124959adc21b554aaa660707dbbe89c.exe
"C:\Users\Admin\AppData\Local\Temp\be69709414e60eae521dc4b85784bceda124959adc21b554aaa660707dbbe89c.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Users\Admin\AppData\Local\Temp\Ocean.exe
  "C:\Users\Admin\AppData\Local\Temp\Ocean.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1704
- C:\Users\Admin\AppData\Local\Temp\ApplicationFrameHost.exe
  "C:\Users\Admin\AppData\Local\Temp\ApplicationFrameHost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ApplicationFrameHost.exe

Filesize
73KB

MD5
59304b625ddc6fa1d95bc09cf84b2fa6

SHA1
e3e14f54a6471570c3e10cc257fa8bedd5492d49

SHA256
440e5bf83310276bef2e72668283fda8eb1e84bdf902632fe0571bfe1ba61204

SHA512
0309e04719424ad52b9bf07c8801ace891b8ffdc1c1f69bae7269086ef296f576bd89d9b1a70b62d4545d83b952439b12de5b17d6e51a187068dd222414ec167

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ocean.exe

Filesize
2.3MB

MD5
286efca498147dedaf4169e9bb297b52

SHA1
a88b65dc85d209a26da56c1d31fc63edb99d0819

SHA256
de824109d13ae96a87c2cfabbc650e05765e1ae36ebe69c4bf16d253f3e7f53d

SHA512
3b4149969308e53bf4f37af4f71d47199f6ba0198fd6e9b0a937daf11c728bdf2f695aa2400c1ee0db7708ed5e48b1cce5596b7a5cce9cafa21e6de8eb5c9ad6

Download Submit
memory/2076-0-0x00007FFBB8963000-0x00007FFBB8965000-memory.dmp

Filesize
8KB

Download
memory/2076-1-0x0000000000E50000-0x00000000010C2000-memory.dmp

Filesize
2.4MB

Download
memory/3952-22-0x00000000003C0000-0x00000000003D8000-memory.dmp

Filesize
96KB

Download
memory/3952-23-0x00007FFBB8960000-0x00007FFBB9421000-memory.dmp

Filesize
10.8MB

Download
memory/3952-24-0x00007FFBB8960000-0x00007FFBB9421000-memory.dmp

Filesize
10.8MB

Download