xworm | 8e8d6f07eb61ec1f1519723d2f71ff6f774b09bd4a3ac6403605d0cb9614a997

Analysis

max time kernel
19s
max time network
21s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
10/11/2024, 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RdpHolder.exe
Size

66KB
MD5

0cec61142ef661a4d438f9fc829fe2d4
SHA1

ad059f47e9c804fc4ba5d98b1e787971afa8dd08
SHA256

8e8d6f07eb61ec1f1519723d2f71ff6f774b09bd4a3ac6403605d0cb9614a997
SHA512

cd79f3f8f9f1fe2263ab79b3972473d76a81c2b807a3937b52e12e69c9b2a13fe100dc3ede9039f9bcfbc2e7c3c23c0ca957e9edee4bd47aad0b36d529a270c9
SSDEEP

1536:TgQa5uZDTELCbzOvKnqYi1M4iL2wzJvYchw69+I:BZ09vsqY8M4i6oJQchw69+I

Score

10^/10

xworm discovery rat trojan

Malware Config

Extracted

Family

xworm

193.161.193.99:24469

Attributes

Install_directory
%Temp%
install_file
USB.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000f00000001756e-5.dat	family_xworm
behavioral1/memory/780-15-0x0000000000310000-0x0000000000324000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Executes dropped EXE 1 IoCs

pid	Process
780	RDP holder.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 13 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2312	PING.EXE
2692	PING.EXE
3020	PING.EXE
1584	PING.EXE
2224	PING.EXE
3036	PING.EXE
2904	PING.EXE
3016	PING.EXE
1676	PING.EXE
2808	PING.EXE
2396	PING.EXE
540	PING.EXE
1984	PING.EXE

Runs ping.exe 1 TTPs 13 IoCs

Remote System Discovery

T1018

pid	Process
2312	PING.EXE
2904	PING.EXE
3016	PING.EXE
2692	PING.EXE
2808	PING.EXE
2396	PING.EXE
3036	PING.EXE
540	PING.EXE
1984	PING.EXE
1676	PING.EXE
1584	PING.EXE
2224	PING.EXE
3020	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	780	RDP holder.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 780	2388	RdpHolder.exe	29
PID 2388 wrote to memory of 780	2388	RdpHolder.exe	29
PID 2388 wrote to memory of 780	2388	RdpHolder.exe	29
PID 2388 wrote to memory of 2984	2388	RdpHolder.exe	30
PID 2388 wrote to memory of 2984	2388	RdpHolder.exe	30
PID 2388 wrote to memory of 2984	2388	RdpHolder.exe	30
PID 2984 wrote to memory of 2312	2984	cmd.exe	32
PID 2984 wrote to memory of 2312	2984	cmd.exe	32
PID 2984 wrote to memory of 2312	2984	cmd.exe	32
PID 2984 wrote to memory of 2904	2984	cmd.exe	33
PID 2984 wrote to memory of 2904	2984	cmd.exe	33
PID 2984 wrote to memory of 2904	2984	cmd.exe	33
PID 2984 wrote to memory of 3016	2984	cmd.exe	34
PID 2984 wrote to memory of 3016	2984	cmd.exe	34
PID 2984 wrote to memory of 3016	2984	cmd.exe	34
PID 2984 wrote to memory of 2692	2984	cmd.exe	36
PID 2984 wrote to memory of 2692	2984	cmd.exe	36
PID 2984 wrote to memory of 2692	2984	cmd.exe	36
PID 2984 wrote to memory of 1676	2984	cmd.exe	37
PID 2984 wrote to memory of 1676	2984	cmd.exe	37
PID 2984 wrote to memory of 1676	2984	cmd.exe	37
PID 2984 wrote to memory of 2808	2984	cmd.exe	38
PID 2984 wrote to memory of 2808	2984	cmd.exe	38
PID 2984 wrote to memory of 2808	2984	cmd.exe	38
PID 2984 wrote to memory of 2396	2984	cmd.exe	39
PID 2984 wrote to memory of 2396	2984	cmd.exe	39
PID 2984 wrote to memory of 2396	2984	cmd.exe	39
PID 2984 wrote to memory of 1584	2984	cmd.exe	40
PID 2984 wrote to memory of 1584	2984	cmd.exe	40
PID 2984 wrote to memory of 1584	2984	cmd.exe	40
PID 2984 wrote to memory of 2224	2984	cmd.exe	41
PID 2984 wrote to memory of 2224	2984	cmd.exe	41
PID 2984 wrote to memory of 2224	2984	cmd.exe	41
PID 2984 wrote to memory of 3020	2984	cmd.exe	42
PID 2984 wrote to memory of 3020	2984	cmd.exe	42
PID 2984 wrote to memory of 3020	2984	cmd.exe	42
PID 2984 wrote to memory of 3036	2984	cmd.exe	43
PID 2984 wrote to memory of 3036	2984	cmd.exe	43
PID 2984 wrote to memory of 3036	2984	cmd.exe	43
PID 2984 wrote to memory of 540	2984	cmd.exe	44
PID 2984 wrote to memory of 540	2984	cmd.exe	44
PID 2984 wrote to memory of 540	2984	cmd.exe	44
PID 2984 wrote to memory of 1984	2984	cmd.exe	45
PID 2984 wrote to memory of 1984	2984	cmd.exe	45
PID 2984 wrote to memory of 1984	2984	cmd.exe	45

C:\Users\Admin\AppData\Local\Temp\RdpHolder.exe
"C:\Users\Admin\AppData\Local\Temp\RdpHolder.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Users\Admin\AppData\Roaming\RDP holder.exe
  "C:\Users\Admin\AppData\Roaming\RDP holder.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:780
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\Rdpholder.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2312
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2904
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3016
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2692
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1676
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2808
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2396
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1584
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2224
- - C:\Windows\system32\PING.EXE
    ping -n 1 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3020
- - C:\Windows\system32\PING.EXE
    ping -n 4 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3036
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:540
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\RDP holder.exe

Filesize
52KB

MD5
8071226092207bae1b0e6fdcc09b9b42

SHA1
a6cb18077f75fdcc0dd591918302fef9c51d0269

SHA256
9be64327c0cb4880d650e65770a3c46b712c851be22b55ad7cc9a797fed44d67

SHA512
bf6bf2b1e36dba8fd9cb9653f5d99849dca3b5a3f2bf5f497441210c07bd938a24c5070ee6e48f6baf3c2805257c3cdd802eec5d8d5678bcfa9486df81c169d6

Download Submit
C:\Users\Admin\AppData\Roaming\Rdpholder.bat

Filesize
2KB

MD5
07d74a3dc98f366a81befc74587d9d2f

SHA1
47db545764b72079c22a149d55676a8d00b8fa48

SHA256
42a3278b4b5376cb977afb9bd2a86dc81adac981629ccfabbe3ddf5c84430164

SHA512
4cf0fe3ec2b3d592a1c8fc00afc93f1b19177aca4422d8cb367486df973b486db62c6d3a69f547acacf6c7607b8590b28a76362ac145ed88ea39feab67751f5b

Download Submit
memory/780-15-0x0000000000310000-0x0000000000324000-memory.dmp

Filesize
80KB

Download
memory/780-17-0x000007FEF59E0000-0x000007FEF63CC000-memory.dmp

Filesize
9.9MB

Download
memory/780-18-0x000007FEF59E0000-0x000007FEF63CC000-memory.dmp

Filesize
9.9MB

Download
memory/780-19-0x000007FEF59E0000-0x000007FEF63CC000-memory.dmp

Filesize
9.9MB

Download
memory/780-20-0x000007FEF59E0000-0x000007FEF63CC000-memory.dmp

Filesize
9.9MB

Download
memory/2388-0-0x000007FEF59E3000-0x000007FEF59E4000-memory.dmp

Filesize
4KB

Download
memory/2388-1-0x0000000000B10000-0x0000000000B26000-memory.dmp

Filesize
88KB

Download