xworm | 210e2e98bf88e3dd17e8ac1b8bdef59cd8fd93dcc5c579bf3a59830b30bc9052

General

Target

210e2e98bf88e3dd17e8ac1b8bdef59cd8fd93dcc5c579bf3a59830b30bc9052.exe
Size

324KB
MD5

610f78dab4043f4ab8d964e226d6edcb
SHA1

383a33247a84f1e5a23334ea1a353d2e6aa7e855
SHA256

210e2e98bf88e3dd17e8ac1b8bdef59cd8fd93dcc5c579bf3a59830b30bc9052
SHA512

0303eeb10caa59274e75676b9f1ad4c5baa7455fb8e3cb4d0a856ecc7d02224931df6c90c18e87fb2cf4212e97f33fa088ba1ae6eb93d39439bee5fbc48e7861
SSDEEP

3072:gA5ta1bMRRlOXk12l4mJe7UmuLchHPHo4bqRH33qGCNxxOe:xAbIMl4miUdLchvo4OlnqR

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

23.ip.gl.ply.gg:40630

147.185.221.23:40630

Attributes

Install_directory
%AppData%
install_file
svchost.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2380-1-0x0000000000CB0000-0x0000000000D08000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1784	powershell.exe
1276	powershell.exe
2488	powershell.exe
2876	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	210e2e98bf88e3dd17e8ac1b8bdef59cd8fd93dcc5c579bf3a59830b30bc9052.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	210e2e98bf88e3dd17e8ac1b8bdef59cd8fd93dcc5c579bf3a59830b30bc9052.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	210e2e98bf88e3dd17e8ac1b8bdef59cd8fd93dcc5c579bf3a59830b30bc9052.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2488	powershell.exe
2876	powershell.exe
1784	powershell.exe
1276	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2380	210e2e98bf88e3dd17e8ac1b8bdef59cd8fd93dcc5c579bf3a59830b30bc9052.exe
Token: SeDebugPrivilege	2488	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeDebugPrivilege	1784	powershell.exe
Token: SeDebugPrivilege	1276	powershell.exe
Token: SeDebugPrivilege	2380	210e2e98bf88e3dd17e8ac1b8bdef59cd8fd93dcc5c579bf3a59830b30bc9052.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2488	2380	210e2e98bf88e3dd17e8ac1b8bdef59cd8fd93dcc5c579bf3a59830b30bc9052.exe	31
PID 2380 wrote to memory of 2488	2380	210e2e98bf88e3dd17e8ac1b8bdef59cd8fd93dcc5c579bf3a59830b30bc9052.exe	31
PID 2380 wrote to memory of 2488	2380	210e2e98bf88e3dd17e8ac1b8bdef59cd8fd93dcc5c579bf3a59830b30bc9052.exe	31
PID 2380 wrote to memory of 2876	2380	210e2e98bf88e3dd17e8ac1b8bdef59cd8fd93dcc5c579bf3a59830b30bc9052.exe	33
PID 2380 wrote to memory of 2876	2380	210e2e98bf88e3dd17e8ac1b8bdef59cd8fd93dcc5c579bf3a59830b30bc9052.exe	33
PID 2380 wrote to memory of 2876	2380	210e2e98bf88e3dd17e8ac1b8bdef59cd8fd93dcc5c579bf3a59830b30bc9052.exe	33
PID 2380 wrote to memory of 1784	2380	210e2e98bf88e3dd17e8ac1b8bdef59cd8fd93dcc5c579bf3a59830b30bc9052.exe	35
PID 2380 wrote to memory of 1784	2380	210e2e98bf88e3dd17e8ac1b8bdef59cd8fd93dcc5c579bf3a59830b30bc9052.exe	35
PID 2380 wrote to memory of 1784	2380	210e2e98bf88e3dd17e8ac1b8bdef59cd8fd93dcc5c579bf3a59830b30bc9052.exe	35
PID 2380 wrote to memory of 1276	2380	210e2e98bf88e3dd17e8ac1b8bdef59cd8fd93dcc5c579bf3a59830b30bc9052.exe	37
PID 2380 wrote to memory of 1276	2380	210e2e98bf88e3dd17e8ac1b8bdef59cd8fd93dcc5c579bf3a59830b30bc9052.exe	37
PID 2380 wrote to memory of 1276	2380	210e2e98bf88e3dd17e8ac1b8bdef59cd8fd93dcc5c579bf3a59830b30bc9052.exe	37

C:\Users\Admin\AppData\Local\Temp\210e2e98bf88e3dd17e8ac1b8bdef59cd8fd93dcc5c579bf3a59830b30bc9052.exe
"C:\Users\Admin\AppData\Local\Temp\210e2e98bf88e3dd17e8ac1b8bdef59cd8fd93dcc5c579bf3a59830b30bc9052.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\210e2e98bf88e3dd17e8ac1b8bdef59cd8fd93dcc5c579bf3a59830b30bc9052.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '210e2e98bf88e3dd17e8ac1b8bdef59cd8fd93dcc5c579bf3a59830b30bc9052.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZCQN9MNI6GUS8L8HXKWP.temp

Filesize
7KB

MD5
c8cce634ecda012ec99859f3eb91e437

SHA1
9133c03f22cff151223805ddfc19506265a39578

SHA256
90d0e04c11fa3f29403922bc2c741a5dec0c39ea0e5c95c6cde073ee6d779180

SHA512
75df264e9fb44f59111c8249f8a4d6fbd89a059c8a2804818ed417a6cca587d33482599b94b95a00cc2e5efbde94692b171a31956426fc82ce5a0d920d34ba0d

Download Submit
memory/2380-0-0x000007FEF6403000-0x000007FEF6404000-memory.dmp

Filesize
4KB

Download
memory/2380-1-0x0000000000CB0000-0x0000000000D08000-memory.dmp

Filesize
352KB

Download
memory/2380-2-0x000007FEF6400000-0x000007FEF6DEC000-memory.dmp

Filesize
9.9MB

Download
memory/2380-16-0x000007FEF6403000-0x000007FEF6404000-memory.dmp

Filesize
4KB

Download
memory/2380-31-0x000007FEF6400000-0x000007FEF6DEC000-memory.dmp

Filesize
9.9MB

Download
memory/2488-7-0x000000001B2F0000-0x000000001B5D2000-memory.dmp

Filesize
2.9MB

Download
memory/2488-8-0x0000000002570000-0x0000000002578000-memory.dmp

Filesize
32KB

Download
memory/2876-14-0x000000001B400000-0x000000001B6E2000-memory.dmp

Filesize
2.9MB

Download
memory/2876-15-0x0000000002330000-0x0000000002338000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads