xworm | ee94f31406ba029502b3737f9d2c2d2d22448643deaa3095239a55b58b9169c8

General

Target

NLHybrid Fixer.exe
Size

42KB
MD5

269085c7755574a5cd840b298a0b4a55
SHA1

3b20a9f3c0e5ed34d37c5c915c07fd93da7d7cbd
SHA256

ee94f31406ba029502b3737f9d2c2d2d22448643deaa3095239a55b58b9169c8
SHA512

47b5782e53cf03bb5eb8f96584b9e0608bc10038b8721761bf67af75ed0b77a2e51ef94a9d62302e6e0d45885e72d47b80815caa8c063a616d50b646885b5f65
SSDEEP

768:yvD19vXwj/0OhWgEiymT+jxPuqF3t9NRX6POChM0LevH:I19/wj/F8iy/P5F99NRX6POCK0k

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

remote-newest.gl.at.ply.gg:62113

fund-scared.gl.at.ply.gg:62113

Mutex

UrM5eoX12ULh6st6

Attributes

Install_directory
%Userprofile%
install_file
win64updater.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2848-1-0x0000000000DF0000-0x0000000000E00000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2576	powershell.exe
2256	powershell.exe
828	powershell.exe
2700	powershell.exe

Deletes itself 1 IoCs

pid	Process
1836	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win64updater.lnk	NLHybrid Fixer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win64updater.lnk	NLHybrid Fixer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\win64updater = "C:\\Users\\Admin\\win64updater.exe"	NLHybrid Fixer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1208	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2600	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2848	NLHybrid Fixer.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2256	powershell.exe
828	powershell.exe
2700	powershell.exe
2576	powershell.exe
2848	NLHybrid Fixer.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2848	NLHybrid Fixer.exe
Token: SeDebugPrivilege	2256	powershell.exe
Token: SeDebugPrivilege	828	powershell.exe
Token: SeDebugPrivilege	2700	powershell.exe
Token: SeDebugPrivilege	2576	powershell.exe
Token: SeDebugPrivilege	2848	NLHybrid Fixer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2848	NLHybrid Fixer.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2256	2848	NLHybrid Fixer.exe	31
PID 2848 wrote to memory of 2256	2848	NLHybrid Fixer.exe	31
PID 2848 wrote to memory of 2256	2848	NLHybrid Fixer.exe	31
PID 2848 wrote to memory of 828	2848	NLHybrid Fixer.exe	33
PID 2848 wrote to memory of 828	2848	NLHybrid Fixer.exe	33
PID 2848 wrote to memory of 828	2848	NLHybrid Fixer.exe	33
PID 2848 wrote to memory of 2700	2848	NLHybrid Fixer.exe	35
PID 2848 wrote to memory of 2700	2848	NLHybrid Fixer.exe	35
PID 2848 wrote to memory of 2700	2848	NLHybrid Fixer.exe	35
PID 2848 wrote to memory of 2576	2848	NLHybrid Fixer.exe	37
PID 2848 wrote to memory of 2576	2848	NLHybrid Fixer.exe	37
PID 2848 wrote to memory of 2576	2848	NLHybrid Fixer.exe	37
PID 2848 wrote to memory of 2600	2848	NLHybrid Fixer.exe	39
PID 2848 wrote to memory of 2600	2848	NLHybrid Fixer.exe	39
PID 2848 wrote to memory of 2600	2848	NLHybrid Fixer.exe	39
PID 2848 wrote to memory of 1808	2848	NLHybrid Fixer.exe	42
PID 2848 wrote to memory of 1808	2848	NLHybrid Fixer.exe	42
PID 2848 wrote to memory of 1808	2848	NLHybrid Fixer.exe	42
PID 2848 wrote to memory of 1836	2848	NLHybrid Fixer.exe	44
PID 2848 wrote to memory of 1836	2848	NLHybrid Fixer.exe	44
PID 2848 wrote to memory of 1836	2848	NLHybrid Fixer.exe	44
PID 1836 wrote to memory of 1208	1836	cmd.exe	46
PID 1836 wrote to memory of 1208	1836	cmd.exe	46
PID 1836 wrote to memory of 1208	1836	cmd.exe	46

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\NLHybrid Fixer.exe
"C:\Users\Admin\AppData\Local\Temp\NLHybrid Fixer.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\NLHybrid Fixer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'NLHybrid Fixer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\win64updater.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'win64updater.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2576
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "win64updater" /tr "C:\Users\Admin\win64updater.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2600
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /f /tn "win64updater"
  2⤵
  PID:1808
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp40D7.tmp.bat""
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp40D7.tmp.bat

Filesize
166B

MD5
24bba24ce6c7f18f14decc7f434b91fc

SHA1
2b8295776125c1628cdb535746dc3feb7c885a74

SHA256
4bc839944bed015e972d45d8befe3dcd4a3ba91de9766e8916ca0834984267e5

SHA512
6c641e56d9befa711e614dbc6b0d84a74c7addd099fb43fbfeabfe441e19106c37d300b033bcfd38a87c3e5d00304ee7153be8fd794ac46d536339a08e32970c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
fdbdfb69f135192350756a9e84d10534

SHA1
1167d88506ecd591eb64f6b6b0748939de1d05e6

SHA256
9ff21c98d15d1b22e2c87fc29c7f3e521c378639f3e1e3a8b2445830f10c1f53

SHA512
f972a9c77687996b9fd890e24e5632c62dadc028f3d3be550d9ab0fe139ed2bc79f152d8a0abc69d8346a3b8b2eb6d829d2c165dab1f5116f5eac4798dafbd32

Download Submit
memory/828-15-0x00000000022C0000-0x00000000022C8000-memory.dmp

Filesize
32KB

Download
memory/828-14-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/2256-7-0x000000001B7B0000-0x000000001BA92000-memory.dmp

Filesize
2.9MB

Download
memory/2256-8-0x0000000001E60000-0x0000000001E68000-memory.dmp

Filesize
32KB

Download
memory/2256-6-0x0000000002C40000-0x0000000002CC0000-memory.dmp

Filesize
512KB

Download
memory/2848-0-0x000007FEF5BE3000-0x000007FEF5BE4000-memory.dmp

Filesize
4KB

Download
memory/2848-31-0x000000001B0F0000-0x000000001B170000-memory.dmp

Filesize
512KB

Download
memory/2848-32-0x000007FEF5BE3000-0x000007FEF5BE4000-memory.dmp

Filesize
4KB

Download
memory/2848-33-0x000000001B0F0000-0x000000001B170000-memory.dmp

Filesize
512KB

Download
memory/2848-1-0x0000000000DF0000-0x0000000000E00000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads