xworm | 62ba4ec06510e37fb216b054b958f8d205e78e81963856e86aa05815d8bb46c9

General

Target

62ba4ec06510e37fb216b054b958f8d205e78e81963856e86aa05815d8bb46c9N.exe
Size

34KB
MD5

4b16d5aa43562f7860fef6f93b444ab0
SHA1

cba12e617ac366cc18cc3f2cf84edd58fd0ab4b1
SHA256

62ba4ec06510e37fb216b054b958f8d205e78e81963856e86aa05815d8bb46c9
SHA512

dd55f368c5703dd4751061068e2f9f44c6dbfa84bc7a06b343b338e92a59e72fb6abb8b355fe35b52deb59d27b059894aadb4d07c330e3b7e9b8069e9b0859e2
SSDEEP

768:AYBpz/QvWZqvoXu24OFrCxxF39XTp6LOjh/bU:AYBpz/QvwtbFGrF39XV6LOjN4

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:26848

on-modules.gl.at.ply.gg:26848

Mutex

wrmsNSNXixl9dMEG

Attributes

Install_directory
%AppData%
install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2484-1-0x0000000000B60000-0x0000000000B6E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2584	powershell.exe
1800	powershell.exe
2680	powershell.exe
2912	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host = "C:\\Users\\Admin\\AppData\\Roaming\\Host"	62ba4ec06510e37fb216b054b958f8d205e78e81963856e86aa05815d8bb46c9N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1800	powershell.exe
2680	powershell.exe
2912	powershell.exe
2584	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2484	62ba4ec06510e37fb216b054b958f8d205e78e81963856e86aa05815d8bb46c9N.exe
Token: SeDebugPrivilege	1800	powershell.exe
Token: SeDebugPrivilege	2680	powershell.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	2584	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 1800	2484	62ba4ec06510e37fb216b054b958f8d205e78e81963856e86aa05815d8bb46c9N.exe	31
PID 2484 wrote to memory of 1800	2484	62ba4ec06510e37fb216b054b958f8d205e78e81963856e86aa05815d8bb46c9N.exe	31
PID 2484 wrote to memory of 1800	2484	62ba4ec06510e37fb216b054b958f8d205e78e81963856e86aa05815d8bb46c9N.exe	31
PID 2484 wrote to memory of 2680	2484	62ba4ec06510e37fb216b054b958f8d205e78e81963856e86aa05815d8bb46c9N.exe	33
PID 2484 wrote to memory of 2680	2484	62ba4ec06510e37fb216b054b958f8d205e78e81963856e86aa05815d8bb46c9N.exe	33
PID 2484 wrote to memory of 2680	2484	62ba4ec06510e37fb216b054b958f8d205e78e81963856e86aa05815d8bb46c9N.exe	33
PID 2484 wrote to memory of 2912	2484	62ba4ec06510e37fb216b054b958f8d205e78e81963856e86aa05815d8bb46c9N.exe	35
PID 2484 wrote to memory of 2912	2484	62ba4ec06510e37fb216b054b958f8d205e78e81963856e86aa05815d8bb46c9N.exe	35
PID 2484 wrote to memory of 2912	2484	62ba4ec06510e37fb216b054b958f8d205e78e81963856e86aa05815d8bb46c9N.exe	35
PID 2484 wrote to memory of 2584	2484	62ba4ec06510e37fb216b054b958f8d205e78e81963856e86aa05815d8bb46c9N.exe	37
PID 2484 wrote to memory of 2584	2484	62ba4ec06510e37fb216b054b958f8d205e78e81963856e86aa05815d8bb46c9N.exe	37
PID 2484 wrote to memory of 2584	2484	62ba4ec06510e37fb216b054b958f8d205e78e81963856e86aa05815d8bb46c9N.exe	37

C:\Users\Admin\AppData\Local\Temp\62ba4ec06510e37fb216b054b958f8d205e78e81963856e86aa05815d8bb46c9N.exe
"C:\Users\Admin\AppData\Local\Temp\62ba4ec06510e37fb216b054b958f8d205e78e81963856e86aa05815d8bb46c9N.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\62ba4ec06510e37fb216b054b958f8d205e78e81963856e86aa05815d8bb46c9N.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '62ba4ec06510e37fb216b054b958f8d205e78e81963856e86aa05815d8bb46c9N.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Host'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Host'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TGO7KX9VJ2JD04ZNBB09.temp

Filesize
7KB

MD5
21f9d4b4ca70f076b80ad32bee2ac2b3

SHA1
29f4294d09f4748cda17223749c47f4dfa4429df

SHA256
5bb26568fe3b08bb175b0f5e54a592604ea9d0e0de5aae0aa4876ba4bb6f7fd4

SHA512
ad0011c547a9f3681b05fbf60dab75c4282aee1d538738ec1b75142beab22cc2e3e2b88a8c8b1d7ad8a3ee207a1198c060366042c2e661927abd25506f8cb50f

Download Submit
memory/1800-6-0x0000000002AD0000-0x0000000002B50000-memory.dmp

Filesize
512KB

Download
memory/1800-8-0x0000000002770000-0x0000000002778000-memory.dmp

Filesize
32KB

Download
memory/1800-7-0x000000001B580000-0x000000001B862000-memory.dmp

Filesize
2.9MB

Download
memory/2484-0-0x000007FEF5813000-0x000007FEF5814000-memory.dmp

Filesize
4KB

Download
memory/2484-1-0x0000000000B60000-0x0000000000B6E000-memory.dmp

Filesize
56KB

Download
memory/2484-28-0x000000001B210000-0x000000001B290000-memory.dmp

Filesize
512KB

Download
memory/2484-29-0x000007FEF5813000-0x000007FEF5814000-memory.dmp

Filesize
4KB

Download
memory/2680-15-0x00000000029F0000-0x00000000029F8000-memory.dmp

Filesize
32KB

Download
memory/2680-14-0x000000001B4B0000-0x000000001B792000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads