xworm | 11af9ee8c345dd8c529ac2ec08ac51129531edb0cfd1fa5a580a36c642502163

General

Target

Loaded GUI SUPER X GODDOM.exe
Size

15.8MB
MD5

122c870b4666083d8672bc45c79db494
SHA1

c8a1b264e6178bb4cf52d022238899036e94574e
SHA256

11af9ee8c345dd8c529ac2ec08ac51129531edb0cfd1fa5a580a36c642502163
SHA512

23a0c79a6507c001d4d656d44a7784715d28e6c5c9716923e9f384b7875f53501fbab397014c3686486689ea33168773bf69af30c3c01fe7f931a65d29da2833
SSDEEP

393216:MNBDE4WXRLTfyXE/rEmkNInlv8K/HSTYwEX9mr4BGk/2uXj:MNJE4Yr+E/rR19xOYwFI+

Score

10^/10

xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

client-toilet.gl.at.ply.gg:29921

Mutex

NvsfH1XO1syyGREn

Attributes

Install_directory
%AppData%
install_file
XClient.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0022000000023807-18.dat	family_xworm
behavioral2/memory/1284-30-0x0000000000350000-0x0000000000366000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	Loaded GUI SUPER X GODDOM.exe

Executes dropped EXE 2 IoCs

pid	Process
1440	Loaded GUI.exe
1284	BLACKGODDOM V.2 GOD BY LA.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 21 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1284	BLACKGODDOM V.2 GOD BY LA.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 1440	448	Loaded GUI SUPER X GODDOM.exe	86
PID 448 wrote to memory of 1440	448	Loaded GUI SUPER X GODDOM.exe	86
PID 448 wrote to memory of 1284	448	Loaded GUI SUPER X GODDOM.exe	88
PID 448 wrote to memory of 1284	448	Loaded GUI SUPER X GODDOM.exe	88
PID 1440 wrote to memory of 2192	1440	Loaded GUI.exe	96
PID 1440 wrote to memory of 2192	1440	Loaded GUI.exe	96
PID 2192 wrote to memory of 3956	2192	cmd.exe	98
PID 2192 wrote to memory of 3956	2192	cmd.exe	98
PID 2192 wrote to memory of 1540	2192	cmd.exe	99
PID 2192 wrote to memory of 1540	2192	cmd.exe	99
PID 2192 wrote to memory of 4372	2192	cmd.exe	100
PID 2192 wrote to memory of 4372	2192	cmd.exe	100
PID 2192 wrote to memory of 4912	2192	cmd.exe	103
PID 2192 wrote to memory of 4912	2192	cmd.exe	103
PID 2192 wrote to memory of 2080	2192	cmd.exe	104
PID 2192 wrote to memory of 2080	2192	cmd.exe	104
PID 2192 wrote to memory of 3936	2192	cmd.exe	105
PID 2192 wrote to memory of 3936	2192	cmd.exe	105
PID 2192 wrote to memory of 1988	2192	cmd.exe	106
PID 2192 wrote to memory of 1988	2192	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\Loaded GUI SUPER X GODDOM.exe
"C:\Users\Admin\AppData\Local\Temp\Loaded GUI SUPER X GODDOM.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:448
- C:\Users\Admin\AppData\Local\Temp\Loaded GUI.exe
  "C:\Users\Admin\AppData\Local\Temp\Loaded GUI.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2192
  - - C:\Windows\system32\netsh.exe
      netsh winsock reset catalog
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:3956
  - - C:\Windows\system32\netsh.exe
      netsh int tcp reset
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:1540
  - - C:\Windows\system32\netsh.exe
      netsh interface ip delete arpcache
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:4372
  - - C:\Windows\system32\netsh.exe
      netsh int tcp set heuristics disabled
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:4912
  - - C:\Windows\system32\netsh.exe
      netsh int tcp set global rss=enabled
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:2080
  - - C:\Windows\system32\netsh.exe
      netsh int tcp set global chimney=disabled
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:3936
  - - C:\Windows\system32\netsh.exe
      netsh int tcp set global netdma=enabled
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:1988
- C:\Users\Admin\AppData\Local\Temp\BLACKGODDOM V.2 GOD BY LA.exe
  "C:\Users\Admin\AppData\Local\Temp\BLACKGODDOM V.2 GOD BY LA.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BLACKGODDOM V.2 GOD BY LA.exe

Filesize
67KB

MD5
2b1bcff698482a45a0d01356ad3e0384

SHA1
77d106b1495b869600cdfda6afeaec0f75a78634

SHA256
a9bd5014b5a6744b0a5c180a3e76ff546a514dcbad8bf2d8c500f903a285424b

SHA512
e8b6a729f3b4fc02886aeed232511dc9407a52aae40f01cd2817f8369944b14240bd3edfd573dbdef0d506557f02622148ce4042f6f497c20f1f11af85eeac77

Download Submit
C:\Users\Admin\AppData\Local\Temp\Loaded GUI.exe

Filesize
15.9MB

MD5
329f5cfa031ecf0b5eb30624277e6321

SHA1
189067b40d2b6b6f0a2e9b3bb509acc01131b15a

SHA256
0139146555814ed3ef16e36fb839dd4265cc5cb033a4500f43ef20b48a506675

SHA512
f97b6de859076d7ed76e497064c75647ca481377e043dc4172ed0c7d37870efaaf776fffb13b71d5f62b2feb6b6daddaff52b9a1ceb4f50f38ff4c0c72561a22

Download Submit
memory/448-0-0x00007FFE4CDD3000-0x00007FFE4CDD5000-memory.dmp

Filesize
8KB

Download
memory/448-1-0x00000000004E0000-0x00000000014BA000-memory.dmp

Filesize
15.9MB

Download
memory/448-2-0x00007FFE4CDD0000-0x00007FFE4D891000-memory.dmp

Filesize
10.8MB

Download
memory/448-26-0x00007FFE4CDD0000-0x00007FFE4D891000-memory.dmp

Filesize
10.8MB

Download
memory/1284-30-0x0000000000350000-0x0000000000366000-memory.dmp

Filesize
88KB

Download
memory/1284-29-0x00007FFE4CDD0000-0x00007FFE4D891000-memory.dmp

Filesize
10.8MB

Download
memory/1284-31-0x00007FFE4CDD0000-0x00007FFE4D891000-memory.dmp

Filesize
10.8MB

Download
memory/1284-32-0x00007FFE4CDD0000-0x00007FFE4D891000-memory.dmp

Filesize
10.8MB

Download
memory/1440-28-0x0000018E459D0000-0x0000018E469C6000-memory.dmp

Filesize
16.0MB

Download
memory/1440-24-0x00007FFE4CDD0000-0x00007FFE4D891000-memory.dmp

Filesize
10.8MB

Download
memory/1440-33-0x00007FFE4CDD0000-0x00007FFE4D891000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads