xworm | 6d2e418121082257cd6ea8ea7adacae1723003d03bde9ea3c0c396e033892f66

General

Target

6d2e418121082257cd6ea8ea7adacae1723003d03bde9ea3c0c396e033892f66.exe
Size

34KB
MD5

121602c80204ce250c2bb4ba098c6e9c
SHA1

e5547e67e3a0efd7611590785143443a23ec9c0c
SHA256

6d2e418121082257cd6ea8ea7adacae1723003d03bde9ea3c0c396e033892f66
SHA512

c96f8738b4e4ff1a3b2f83d77689d0d4429e26c44b5d64124fbea458d087704f28dc1960c45825a36f1c54c2ce997657d738d8be653f81c8e8d7cddd41588b09
SSDEEP

768:AYBpz/QvWZqvoXu24OFrCxxF39XTp6LOjh/bUJ:AYBpz/QvwtbFGrF39XV6LOjN4J

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:26848

on-modules.gl.at.ply.gg:26848

Mutex

wrmsNSNXixl9dMEG

Attributes

Install_directory
%AppData%
install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1488-1-0x0000000000D50000-0x0000000000D5E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2440	powershell.exe
2768	powershell.exe
2904	powershell.exe
2544	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host = "C:\\Users\\Admin\\AppData\\Roaming\\Host"	6d2e418121082257cd6ea8ea7adacae1723003d03bde9ea3c0c396e033892f66.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2544	powershell.exe
2440	powershell.exe
2768	powershell.exe
2904	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1488	6d2e418121082257cd6ea8ea7adacae1723003d03bde9ea3c0c396e033892f66.exe
Token: SeDebugPrivilege	2544	powershell.exe
Token: SeDebugPrivilege	2440	powershell.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeDebugPrivilege	2904	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 2544	1488	6d2e418121082257cd6ea8ea7adacae1723003d03bde9ea3c0c396e033892f66.exe	31
PID 1488 wrote to memory of 2544	1488	6d2e418121082257cd6ea8ea7adacae1723003d03bde9ea3c0c396e033892f66.exe	31
PID 1488 wrote to memory of 2544	1488	6d2e418121082257cd6ea8ea7adacae1723003d03bde9ea3c0c396e033892f66.exe	31
PID 1488 wrote to memory of 2440	1488	6d2e418121082257cd6ea8ea7adacae1723003d03bde9ea3c0c396e033892f66.exe	33
PID 1488 wrote to memory of 2440	1488	6d2e418121082257cd6ea8ea7adacae1723003d03bde9ea3c0c396e033892f66.exe	33
PID 1488 wrote to memory of 2440	1488	6d2e418121082257cd6ea8ea7adacae1723003d03bde9ea3c0c396e033892f66.exe	33
PID 1488 wrote to memory of 2768	1488	6d2e418121082257cd6ea8ea7adacae1723003d03bde9ea3c0c396e033892f66.exe	35
PID 1488 wrote to memory of 2768	1488	6d2e418121082257cd6ea8ea7adacae1723003d03bde9ea3c0c396e033892f66.exe	35
PID 1488 wrote to memory of 2768	1488	6d2e418121082257cd6ea8ea7adacae1723003d03bde9ea3c0c396e033892f66.exe	35
PID 1488 wrote to memory of 2904	1488	6d2e418121082257cd6ea8ea7adacae1723003d03bde9ea3c0c396e033892f66.exe	37
PID 1488 wrote to memory of 2904	1488	6d2e418121082257cd6ea8ea7adacae1723003d03bde9ea3c0c396e033892f66.exe	37
PID 1488 wrote to memory of 2904	1488	6d2e418121082257cd6ea8ea7adacae1723003d03bde9ea3c0c396e033892f66.exe	37

C:\Users\Admin\AppData\Local\Temp\6d2e418121082257cd6ea8ea7adacae1723003d03bde9ea3c0c396e033892f66.exe
"C:\Users\Admin\AppData\Local\Temp\6d2e418121082257cd6ea8ea7adacae1723003d03bde9ea3c0c396e033892f66.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\6d2e418121082257cd6ea8ea7adacae1723003d03bde9ea3c0c396e033892f66.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '6d2e418121082257cd6ea8ea7adacae1723003d03bde9ea3c0c396e033892f66.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Host'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Host'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
ebdaa6e0f48c463de6b3629a19493ec2

SHA1
1e29b7163f7dcd8caa2df749a0cb460073866291

SHA256
2a382692cf56a80b0c411b7f5adc9ff6b393dde124e9a65c6e87295635fe007f

SHA512
23a4a226acd45939f32e13c72a5326891b965ef7fd5470429b3c47c12a6c5deb907ecd237f269fdf7ac444040dc22bc894733e37a67c8ce673f1f954aaea8349

Download Submit
memory/1488-0-0x000007FEF5B13000-0x000007FEF5B14000-memory.dmp

Filesize
4KB

Download
memory/1488-1-0x0000000000D50000-0x0000000000D5E000-memory.dmp

Filesize
56KB

Download
memory/1488-28-0x000000001B090000-0x000000001B110000-memory.dmp

Filesize
512KB

Download
memory/1488-29-0x000000001B090000-0x000000001B110000-memory.dmp

Filesize
512KB

Download
memory/2440-14-0x000000001B700000-0x000000001B9E2000-memory.dmp

Filesize
2.9MB

Download
memory/2440-15-0x0000000001C90000-0x0000000001C98000-memory.dmp

Filesize
32KB

Download
memory/2544-6-0x0000000002810000-0x0000000002890000-memory.dmp

Filesize
512KB

Download
memory/2544-7-0x000000001B4B0000-0x000000001B792000-memory.dmp

Filesize
2.9MB

Download
memory/2544-8-0x00000000028E0000-0x00000000028E8000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads