xworm | 054f80d76dacb9d1165f12a3052990cfcad73ec63ba4fb5305ced170e43e56f4

General

Target

CrossHairX.exe
Size

39KB
MD5

080026dbcae03f2bfea9bee4ac687fe7
SHA1

3f16542806354dad25c5bae3fd9e2bc7d7e3d36b
SHA256

054f80d76dacb9d1165f12a3052990cfcad73ec63ba4fb5305ced170e43e56f4
SHA512

2fefcfc6191b74f28393db4da5a797a362688ff07d0bfce31bc4a0b24ff83d99fe84520bdf3300529241a68c765d9026816bbc93e69bcde479c0a6a5b1738ffd
SSDEEP

768:2jwkGJWkrdf8bpJ6eaWaNmUTHnFPp9nCw6pO9huu5G:2jrGJWHKeAQ+HFx9nCw6pO94p

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

hosting-doe.gl.at.ply.gg:20006

Mutex

4ZfxXQlNchTSkPtE

Attributes

Install_directory
%AppData%
install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/3012-1-0x0000000000C40000-0x0000000000C50000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2724	powershell.exe
2164	powershell.exe
2780	powershell.exe
2344	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	CrossHairX.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	CrossHairX.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost"	CrossHairX.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2164	powershell.exe
2780	powershell.exe
2344	powershell.exe
2724	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3012	CrossHairX.exe
Token: SeDebugPrivilege	2164	powershell.exe
Token: SeDebugPrivilege	2780	powershell.exe
Token: SeDebugPrivilege	2344	powershell.exe
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeDebugPrivilege	3012	CrossHairX.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2164	3012	CrossHairX.exe	30
PID 3012 wrote to memory of 2164	3012	CrossHairX.exe	30
PID 3012 wrote to memory of 2164	3012	CrossHairX.exe	30
PID 3012 wrote to memory of 2780	3012	CrossHairX.exe	32
PID 3012 wrote to memory of 2780	3012	CrossHairX.exe	32
PID 3012 wrote to memory of 2780	3012	CrossHairX.exe	32
PID 3012 wrote to memory of 2344	3012	CrossHairX.exe	34
PID 3012 wrote to memory of 2344	3012	CrossHairX.exe	34
PID 3012 wrote to memory of 2344	3012	CrossHairX.exe	34
PID 3012 wrote to memory of 2724	3012	CrossHairX.exe	36
PID 3012 wrote to memory of 2724	3012	CrossHairX.exe	36
PID 3012 wrote to memory of 2724	3012	CrossHairX.exe	36

C:\Users\Admin\AppData\Local\Temp\CrossHairX.exe
"C:\Users\Admin\AppData\Local\Temp\CrossHairX.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\CrossHairX.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'CrossHairX.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
917fdae6bf7aebe50110c905e9483800

SHA1
f9514bd085c8cc2fc2c26adeff9b397f1762bfbf

SHA256
7806ec2a0fe2d7df1a74995fd2756ed2623761dd2150885ac4c9372283cc78d9

SHA512
b557cdd584f403a688261fb09873f7d75cd3bb806d37dde6fd28600f25ab16dbd659854aebcce86029a0ed3dadb523f8335e5c8a006872b7553083f25f84c8ca

Download Submit
memory/2164-6-0x0000000002900000-0x0000000002980000-memory.dmp

Filesize
512KB

Download
memory/2164-7-0x000000001B560000-0x000000001B842000-memory.dmp

Filesize
2.9MB

Download
memory/2164-8-0x0000000001E70000-0x0000000001E78000-memory.dmp

Filesize
32KB

Download
memory/2780-14-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/2780-15-0x0000000001E70000-0x0000000001E78000-memory.dmp

Filesize
32KB

Download
memory/3012-0-0x000007FEF4E33000-0x000007FEF4E34000-memory.dmp

Filesize
4KB

Download
memory/3012-1-0x0000000000C40000-0x0000000000C50000-memory.dmp

Filesize
64KB

Download
memory/3012-29-0x0000000002260000-0x00000000022E0000-memory.dmp

Filesize
512KB

Download
memory/3012-30-0x0000000002260000-0x00000000022E0000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads