xworm | 66e240c85756cdd733ba77fd2a3f1807a2c960e47c220fcd646b9758c0b1905d

Analysis

max time kernel
123s
max time network
126s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
17-11-2024 04:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Decryption.exe
Size

89KB
MD5

135041cb6c4e66156a9cc5af89db818e
SHA1

b80b813743bb5441ed38166f0975953631115a26
SHA256

66e240c85756cdd733ba77fd2a3f1807a2c960e47c220fcd646b9758c0b1905d
SHA512

6c7655a213d4990d7f63f880e5fb17f366e9d53f7c78310a7d11acde66116683305d630d98585583bd04c50e2a582173fc4722742ffa0249902de95d3ba67b7f
SSDEEP

1536:WaBsJpMRlSEwuW6Lp7h0YLgpTqNGOmoD/AVtgl2mYrJ/EEebWjD2mPsD:WagSWuW4Jh3QgGwMV6/Y1ab4VPsD

Score

10^/10

xworm evasion execution persistence rat trojan

Malware Config

Extracted

Family

xworm

while-stuffed.gl.at.ply.gg:61275

Attributes

Install_directory
%ProgramData%
install_file
USB.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/3940-46-0x000000001D260000-0x000000001D278000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1568	powershell.exe
4596	powershell.exe
3892	powershell.exe
764	powershell.exe
2944	powershell.exe
4644	powershell.exe

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation	Decryption.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryption.lnk	Decryption.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryption.lnk	Decryption.exe

Executes dropped EXE 2 IoCs

pid	Process
4056	Decryption.exe
4668	Decryption.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Decryption = "C:\\ProgramData\\Decryption.exe"	Decryption.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4724	schtasks.exe
3220	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3892	powershell.exe
3892	powershell.exe
764	powershell.exe
764	powershell.exe
2944	powershell.exe
2944	powershell.exe
4644	powershell.exe
4644	powershell.exe
1568	powershell.exe
1568	powershell.exe
4596	powershell.exe
4596	powershell.exe
3940	Decryption.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3940	Decryption.exe
Token: SeDebugPrivilege	3892	powershell.exe
Token: SeIncreaseQuotaPrivilege	3892	powershell.exe
Token: SeSecurityPrivilege	3892	powershell.exe
Token: SeTakeOwnershipPrivilege	3892	powershell.exe
Token: SeLoadDriverPrivilege	3892	powershell.exe
Token: SeSystemProfilePrivilege	3892	powershell.exe
Token: SeSystemtimePrivilege	3892	powershell.exe
Token: SeProfSingleProcessPrivilege	3892	powershell.exe
Token: SeIncBasePriorityPrivilege	3892	powershell.exe
Token: SeCreatePagefilePrivilege	3892	powershell.exe
Token: SeBackupPrivilege	3892	powershell.exe
Token: SeRestorePrivilege	3892	powershell.exe
Token: SeShutdownPrivilege	3892	powershell.exe
Token: SeDebugPrivilege	3892	powershell.exe
Token: SeSystemEnvironmentPrivilege	3892	powershell.exe
Token: SeRemoteShutdownPrivilege	3892	powershell.exe
Token: SeUndockPrivilege	3892	powershell.exe
Token: SeManageVolumePrivilege	3892	powershell.exe
Token: 33	3892	powershell.exe
Token: 34	3892	powershell.exe
Token: 35	3892	powershell.exe
Token: 36	3892	powershell.exe
Token: SeDebugPrivilege	764	powershell.exe
Token: SeIncreaseQuotaPrivilege	764	powershell.exe
Token: SeSecurityPrivilege	764	powershell.exe
Token: SeTakeOwnershipPrivilege	764	powershell.exe
Token: SeLoadDriverPrivilege	764	powershell.exe
Token: SeSystemProfilePrivilege	764	powershell.exe
Token: SeSystemtimePrivilege	764	powershell.exe
Token: SeProfSingleProcessPrivilege	764	powershell.exe
Token: SeIncBasePriorityPrivilege	764	powershell.exe
Token: SeCreatePagefilePrivilege	764	powershell.exe
Token: SeBackupPrivilege	764	powershell.exe
Token: SeRestorePrivilege	764	powershell.exe
Token: SeShutdownPrivilege	764	powershell.exe
Token: SeDebugPrivilege	764	powershell.exe
Token: SeSystemEnvironmentPrivilege	764	powershell.exe
Token: SeRemoteShutdownPrivilege	764	powershell.exe
Token: SeUndockPrivilege	764	powershell.exe
Token: SeManageVolumePrivilege	764	powershell.exe
Token: 33	764	powershell.exe
Token: 34	764	powershell.exe
Token: 35	764	powershell.exe
Token: 36	764	powershell.exe
Token: SeDebugPrivilege	2944	powershell.exe
Token: SeIncreaseQuotaPrivilege	2944	powershell.exe
Token: SeSecurityPrivilege	2944	powershell.exe
Token: SeTakeOwnershipPrivilege	2944	powershell.exe
Token: SeLoadDriverPrivilege	2944	powershell.exe
Token: SeSystemProfilePrivilege	2944	powershell.exe
Token: SeSystemtimePrivilege	2944	powershell.exe
Token: SeProfSingleProcessPrivilege	2944	powershell.exe
Token: SeIncBasePriorityPrivilege	2944	powershell.exe
Token: SeCreatePagefilePrivilege	2944	powershell.exe
Token: SeBackupPrivilege	2944	powershell.exe
Token: SeRestorePrivilege	2944	powershell.exe
Token: SeShutdownPrivilege	2944	powershell.exe
Token: SeDebugPrivilege	2944	powershell.exe
Token: SeSystemEnvironmentPrivilege	2944	powershell.exe
Token: SeRemoteShutdownPrivilege	2944	powershell.exe
Token: SeUndockPrivilege	2944	powershell.exe
Token: SeManageVolumePrivilege	2944	powershell.exe
Token: 33	2944	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3940	Decryption.exe
3940	Decryption.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3940	Decryption.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 3892	3940	Decryption.exe	87
PID 3940 wrote to memory of 3892	3940	Decryption.exe	87
PID 3940 wrote to memory of 764	3940	Decryption.exe	91
PID 3940 wrote to memory of 764	3940	Decryption.exe	91
PID 3940 wrote to memory of 2944	3940	Decryption.exe	93
PID 3940 wrote to memory of 2944	3940	Decryption.exe	93
PID 3940 wrote to memory of 4724	3940	Decryption.exe	96
PID 3940 wrote to memory of 4724	3940	Decryption.exe	96
PID 3940 wrote to memory of 4644	3940	Decryption.exe	98
PID 3940 wrote to memory of 4644	3940	Decryption.exe	98
PID 3940 wrote to memory of 1568	3940	Decryption.exe	102
PID 3940 wrote to memory of 1568	3940	Decryption.exe	102
PID 3940 wrote to memory of 4596	3940	Decryption.exe	104
PID 3940 wrote to memory of 4596	3940	Decryption.exe	104
PID 3940 wrote to memory of 3220	3940	Decryption.exe	106
PID 3940 wrote to memory of 3220	3940	Decryption.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Decryption.exe
"C:\Users\Admin\AppData\Local\Temp\Decryption.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Decryption.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Decryption.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Decryption.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2944
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /rl highest /tn "Decryption" /tr "C:\ProgramData\Decryption.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Decryption.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Decryption.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Decryption.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4596
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Decryption" /tr "C:\ProgramData\Decryption.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3220

C:\ProgramData\Decryption.exe
"C:\ProgramData\Decryption.exe"
1⤵
- Executes dropped EXE
PID:4056

C:\ProgramData\Decryption.exe
"C:\ProgramData\Decryption.exe"
1⤵
- Executes dropped EXE
PID:4668

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x45c 0x488
1⤵
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Decryption.exe

Filesize
89KB

MD5
135041cb6c4e66156a9cc5af89db818e

SHA1
b80b813743bb5441ed38166f0975953631115a26

SHA256
66e240c85756cdd733ba77fd2a3f1807a2c960e47c220fcd646b9758c0b1905d

SHA512
6c7655a213d4990d7f63f880e5fb17f366e9d53f7c78310a7d11acde66116683305d630d98585583bd04c50e2a582173fc4722742ffa0249902de95d3ba67b7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Decryption.exe.log

Filesize
1KB

MD5
2b4889ecb49120375fdf2bccb3c0966e

SHA1
fc1ee2f1161887e3f8b0cdd2453ae441739b993a

SHA256
7bf24ff0f6791ef902937b3caba0de16814a2c898dfb103d922c48582b602379

SHA512
8d737276620add4738d3cb484bca8e1efe23247955d37ebad199d2428f2f494e10dbee98721a77c7fa9d55f662c230acb206894538da9b8a9d0314166b5549a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
3eb3833f769dd890afc295b977eab4b4

SHA1
e857649b037939602c72ad003e5d3698695f436f

SHA256
c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485

SHA512
c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
6a807b1c91ac66f33f88a787d64904c1

SHA1
83c554c7de04a8115c9005709e5cd01fca82c5d3

SHA256
155314c1c86d8d4e5b802f1eef603c5dd4a2f7c949f069a38af5ba4959bd8256

SHA512
29f2d9f30fc081e7fe6e9fb772c810c9be0422afdc6aff5a286f49a990ededebcf0d083798c2d9f41ad8434393c6d0f5fa6df31226d9c3511ba2a41eb4a65200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
705133121e18d0f8fab7848502dc9b85

SHA1
e03a4425450c04e3cd5ccc07424a1989ca12ea27

SHA256
88eb8c45ee90ecbc0edbe0b2108b2ace11cda293150ba75388808043a105ea3f

SHA512
d88de3a89f05f711551d2ffaa16b3caf5b2616849f0d1391bc382ce3539f9b4614b6188d6bddbc33bead418c38ce7173f45e716c42be5aa1413dad90def9e0ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
650756f37f15f837914577997aebf22d

SHA1
1abbcd817eeacd805dc18745ec87d20b6df877f2

SHA256
100a91aff78da5496031e78c752d8d654ed9ed8721533f82b04166c74316034e

SHA512
28312e0a643d79f5c50da4c25412ce2325038a8fe387e0929430c83277c7a84581fb73405b09db141bffaa9feaebcbf662ec4fb9b1df3cfe34f3830d98a08a52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0588388ba889090d352aaf2786dcbb4e

SHA1
76ee620137619824a49ac06d999890aa2e0fe4f5

SHA256
1fd6c025e5a91c737a6b3eefb1720818b03a34b723adc9d05ddef7c51d400fbd

SHA512
6a8243f7d60f21f193668b6424b7f7e35b0d77e714c977bdc7371be38f4e34146e63fc91c6e72415a13537ad29a8ff9ca887ff6c161aba6ad359128c21f1b1d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
192165d464d37057570debffecdad4a7

SHA1
768a6b4f4973b291712228c531b2d49cdf818413

SHA256
d8102c850edc082bc5a7e03747fb92ff8d093877cd6ea98459244e1e8df86151

SHA512
5a7655638073eb51fc9dfcd8a4679e0cabcbcf9d115ddd5e7936161f98ac703d27662c6ecad30e23a4bc1c40547b4bfa3d2e73db25d0740cbc47e3fe4eb428d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w5pbazyq.u0e.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3892-14-0x00007FFA6FF30000-0x00007FFA709F2000-memory.dmp

Filesize
10.8MB

Download
memory/3892-17-0x00007FFA6FF30000-0x00007FFA709F2000-memory.dmp

Filesize
10.8MB

Download
memory/3892-15-0x00007FFA6FF30000-0x00007FFA709F2000-memory.dmp

Filesize
10.8MB

Download
memory/3892-13-0x00007FFA6FF30000-0x00007FFA709F2000-memory.dmp

Filesize
10.8MB

Download
memory/3892-20-0x00007FFA6FF30000-0x00007FFA709F2000-memory.dmp

Filesize
10.8MB

Download
memory/3892-12-0x000002B075020000-0x000002B075042000-memory.dmp

Filesize
136KB

Download
memory/3892-16-0x00007FFA6FF30000-0x00007FFA709F2000-memory.dmp

Filesize
10.8MB

Download
memory/3940-33-0x00007FFA6FF33000-0x00007FFA6FF35000-memory.dmp

Filesize
8KB

Download
memory/3940-47-0x00007FFA6FF30000-0x00007FFA709F2000-memory.dmp

Filesize
10.8MB

Download
memory/3940-0-0x00007FFA6FF33000-0x00007FFA6FF35000-memory.dmp

Filesize
8KB

Download
memory/3940-46-0x000000001D260000-0x000000001D278000-memory.dmp

Filesize
96KB

Download
memory/3940-2-0x00007FFA6FF30000-0x00007FFA709F2000-memory.dmp

Filesize
10.8MB

Download
memory/3940-94-0x0000000001500000-0x000000000150C000-memory.dmp

Filesize
48KB

Download
memory/3940-95-0x0000000001530000-0x000000000153A000-memory.dmp

Filesize
40KB

Download
memory/3940-1-0x0000000000D50000-0x0000000000D6C000-memory.dmp

Filesize
112KB

Download