Overview

overview

10

Static

static

3

6f29de59bd...07.exe

windows7-x64

10

6f29de59bd...07.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-11-2024 23:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6f29de59bd022c91ea367bf1c0dbe58fb51f410d97e974ddbfdee97ad08b5807.exe

  • Size

    1.8MB

  • MD5

    8bef43743abe0709a6c215e4bd40f037

  • SHA1

    4c87bf94e544db943d7800cab9b9005fd15a15ac

  • SHA256

    6f29de59bd022c91ea367bf1c0dbe58fb51f410d97e974ddbfdee97ad08b5807

  • SHA512

    49a6eb3b8e47319cfc324c034a92e5876443039099319883f9ac7c96ae1642272a0ed9613a753e6f96682f328f4420d4c13361176e16baa9b721d8e53d92450f

  • SSDEEP

    49152:U9vUdN2sefykAtpQdsPMEUGN4+ojfzN4D:yM2XEPQdsPMEl1ojm

Score
10/10
xwormdiscoveryevasionexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:8938

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

  • telegram

    https://api.telegram.org/bot6673004050:AAEcDfPnnGAswDvyrn9-bkOySVSnbPqLnBU/sendMessage?chat_id=1470436579

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6f29de59bd022c91ea367bf1c0dbe58fb51f410d97e974ddbfdee97ad08b5807.exe
    "C:\Users\Admin\AppData\Local\Temp\6f29de59bd022c91ea367bf1c0dbe58fb51f410d97e974ddbfdee97ad08b5807.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Drops startup file
    • Identifies Wine through registry keys
    • Adds Run key to start application
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2012
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\6f29de59bd022c91ea367bf1c0dbe58fb51f410d97e974ddbfdee97ad08b5807.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1268
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '6f29de59bd022c91ea367bf1c0dbe58fb51f410d97e974ddbfdee97ad08b5807.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2112
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1100
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1828
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

1
T1112

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Virtualization/Sandbox Evasion

2
T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
    Filesize

    2KB

    MD5

    968cb9309758126772781b83adb8a28f

    SHA1

    8da30e71accf186b2ba11da1797cf67f8f78b47c

    SHA256

    92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

    SHA512

    4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    18KB

    MD5

    d4101ea4ae785df2209d6d70fe98b592

    SHA1

    a647f0185e972ecab21ae14e70d38811fe2f470f

    SHA256

    6e20c76797ee94c5359e67f24c7892dc1f77cbc0233598c36bf6b3603fc9f9b2

    SHA512

    0399de6f51ae64f6b8b3412674c8cfcb328ad7d1634518a74f6008dc041e82128d215de2c1f34e81cfedc6ebd1b503c3757fd8e36f546f1f63fc5e9b902dca54

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    18KB

    MD5

    9a9c2346c334e84c3b441fe00fcdd0d2

    SHA1

    07fae16a2240d0307ddec14730bd519a7e72ed1c

    SHA256

    bf06ccd7c4f58a9855250c53bb7c58355e71888a3e3a91c3d401a9008eaea451

    SHA512

    be041b3f32e173db43ad1cfb0de3bd1c1bababa7b3beb86bc94534b03c5f4050c695a182be25b7615e5a1d4105024785113b3b3259613bfd14aea9490843c701

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    18KB

    MD5

    c9ccd0539f5f09194c0f470c8495b02a

    SHA1

    e0227786b64cc249d2307d99beea80f5e5a1d846

    SHA256

    89eac64a1b48137b968c7acf0e8e807d05901e7ede2fc91091321a95a4f32322

    SHA512

    9c07c3f045959cc8ef59d3ab6667fbdf301619457e2373cd3ddedb45d11e0ecf72f8673f8acd23c740b1a5feeea9e562c69dc594dc7281d8cd210f1b031061b0

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ud5j3lih.3g2.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • memory/1100-80-0x000000006F970000-0x000000006F9BC000-memory.dmp

    Filesize

    304KB

    Download

  • memory/1268-9-0x0000000006190000-0x00000000064E4000-memory.dmp

    Filesize

    3.3MB

    Download

  • memory/1268-40-0x0000000007CD0000-0x0000000007CE4000-memory.dmp

    Filesize

    80KB

    Download

  • memory/1268-7-0x00000000058B0000-0x00000000058D2000-memory.dmp

    Filesize

    136KB

    Download

  • memory/1268-5-0x0000000002E90000-0x0000000002EC6000-memory.dmp

    Filesize

    216KB

    Download

  • memory/1268-6-0x0000000005A80000-0x00000000060A8000-memory.dmp

    Filesize

    6.2MB

    Download

  • memory/1268-19-0x0000000006780000-0x000000000679E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/1268-20-0x00000000067A0000-0x00000000067EC000-memory.dmp

    Filesize

    304KB

    Download

  • memory/1268-21-0x0000000006D50000-0x0000000006D82000-memory.dmp

    Filesize

    200KB

    Download

  • memory/1268-22-0x000000006F970000-0x000000006F9BC000-memory.dmp

    Filesize

    304KB

    Download

  • memory/1268-32-0x0000000006D10000-0x0000000006D2E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/1268-33-0x00000000079C0000-0x0000000007A63000-memory.dmp

    Filesize

    652KB

    Download

  • memory/1268-34-0x00000000080F0000-0x000000000876A000-memory.dmp

    Filesize

    6.5MB

    Download

  • memory/1268-35-0x0000000007A90000-0x0000000007AAA000-memory.dmp

    Filesize

    104KB

    Download

  • memory/1268-36-0x0000000007B00000-0x0000000007B0A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/1268-37-0x0000000007D10000-0x0000000007DA6000-memory.dmp

    Filesize

    600KB

    Download

  • memory/1268-38-0x0000000007C90000-0x0000000007CA1000-memory.dmp

    Filesize

    68KB

    Download

  • memory/1268-39-0x0000000007CC0000-0x0000000007CCE000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1268-8-0x0000000005950000-0x00000000059B6000-memory.dmp

    Filesize

    408KB

    Download

  • memory/1268-41-0x0000000007DD0000-0x0000000007DEA000-memory.dmp

    Filesize

    104KB

    Download

  • memory/1268-42-0x0000000007DB0000-0x0000000007DB8000-memory.dmp

    Filesize

    32KB

    Download

  • memory/1828-100-0x0000000005A10000-0x0000000005D64000-memory.dmp

    Filesize

    3.3MB

    Download

  • memory/1828-102-0x000000006F970000-0x000000006F9BC000-memory.dmp

    Filesize

    304KB

    Download

  • memory/2012-4-0x0000000007570000-0x00000000075D6000-memory.dmp

    Filesize

    408KB

    Download

  • memory/2012-44-0x00000000009B0000-0x0000000000E20000-memory.dmp

    Filesize

    4.4MB

    Download

  • memory/2012-3-0x00000000074D0000-0x000000000756C000-memory.dmp

    Filesize

    624KB

    Download

  • memory/2012-2-0x00000000009B0000-0x0000000000E20000-memory.dmp

    Filesize

    4.4MB

    Download

  • memory/2012-1-0x00000000009B0000-0x0000000000E20000-memory.dmp

    Filesize

    4.4MB

    Download

  • memory/2012-0-0x00000000009B0000-0x0000000000E20000-memory.dmp

    Filesize

    4.4MB

    Download

  • memory/2012-114-0x0000000009010000-0x00000000095B4000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/2012-115-0x0000000008D60000-0x0000000008DF2000-memory.dmp

    Filesize

    584KB

    Download

  • memory/2012-116-0x0000000008B50000-0x0000000008B5A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2112-59-0x000000006F970000-0x000000006F9BC000-memory.dmp

    Filesize

    304KB

    Download

  • memory/2112-57-0x0000000005ED0000-0x0000000006224000-memory.dmp

    Filesize

    3.3MB

    Download