xworm | 69271c328db46c14628d161ff9fed12b14567dfaae2e139ec6cbc047ebca497d

General

Target

XWorm V5.6/XwormV5.6.exe
Size

15.0MB
MD5

2ff4c5a7eff1d9f19e23156dceeca4d0
SHA1

d8c175bb2b968713d48b37e1d018c8736a34ea6d
SHA256

198f82a2b491cb5c769d25c03ea7908161e20a9b51b585099f7088cef5c4323e
SHA512

2c839576c2a9ce47b4d37325417a4055e4f8674323b6b1a558fac35628eaf32e354271936ceb8dc6a38ccc24b170cc17c08e74a994e8363831b410810d676a05
SSDEEP

3072:LJKhDbtkb2D7wyOQnxZd+xYoPdLa5a47Qnx5RUUOMlv1s8W:LJKhDSbFGExYoPJatsjtlv1s8

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

C2

193.161.193.99:63603

37.4.250.173:63603

Attributes

Install_directory
%AppData%
install_file
XwormV6.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral3/memory/6140-1-0x0000000000350000-0x0000000000374000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
224	powershell.exe
1584	powershell.exe
4888	powershell.exe
1944	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XwormV6.lnk	XwormV5.6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XwormV6.lnk	XwormV5.6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
224	powershell.exe
224	powershell.exe
1584	powershell.exe
1584	powershell.exe
4888	powershell.exe
4888	powershell.exe
1944	powershell.exe
1944	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	6140	XwormV5.6.exe
Token: SeDebugPrivilege	224	powershell.exe
Token: SeDebugPrivilege	1584	powershell.exe
Token: SeDebugPrivilege	4888	powershell.exe
Token: SeDebugPrivilege	1944	powershell.exe
Token: SeDebugPrivilege	6140	XwormV5.6.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 6140 wrote to memory of 224	6140	XwormV5.6.exe	77
PID 6140 wrote to memory of 224	6140	XwormV5.6.exe	77
PID 6140 wrote to memory of 1584	6140	XwormV5.6.exe	79
PID 6140 wrote to memory of 1584	6140	XwormV5.6.exe	79
PID 6140 wrote to memory of 4888	6140	XwormV5.6.exe	81
PID 6140 wrote to memory of 4888	6140	XwormV5.6.exe	81
PID 6140 wrote to memory of 1944	6140	XwormV5.6.exe	83
PID 6140 wrote to memory of 1944	6140	XwormV5.6.exe	83

C:\Users\Admin\AppData\Local\Temp\XWorm V5.6\XwormV5.6.exe
"C:\Users\Admin\AppData\Local\Temp\XWorm V5.6\XwormV5.6.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XWorm V5.6\XwormV5.6.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XwormV5.6.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XwormV6.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XwormV6.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e3840d9bcedfe7017e49ee5d05bd1c46

SHA1
272620fb2605bd196df471d62db4b2d280a363c6

SHA256
3ac83e70415b9701ee71a4560232d7998e00c3db020fde669eb01b8821d2746f

SHA512
76adc88ab3930acc6b8b7668e2de797b8c00edcfc41660ee4485259c72a8adf162db62c2621ead5a9950f12bfe8a76ccab79d02fda11860afb0e217812cac376

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cef328ddb1ee8916e7a658919323edd8

SHA1
a676234d426917535e174f85eabe4ef8b88256a5

SHA256
a1b5b7ada8ebc910f20f91ada3991d3321104e9da598c958b1edac9f9aca0e90

SHA512
747400c20ca5b5fd1b54bc24e75e6a78f15af61df263be932d2ee7b2f34731c2de8ce03b2706954fb098c1ac36f0b761cf37e418738fa91f2a8ea78572f545cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9dd876d6004f9e894c7d8de6ae950e5b

SHA1
48f0b4c5f0203788acdeceee62a69df0022dc8d4

SHA256
6e19ea46b5d0c9d58c6fc3c6187e5b821f1600cc25d675d25c8fd829f7194344

SHA512
3f5be2cb27900546eb791f5d5f1274c787f9a4645647b9943a5502c2167ec8a5d9ab653f2efc088d6ea6e8057b63caf3dce0a376f0b88d62f43b68bfa1518324

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ttl1xayv.g54.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/224-10-0x00000252CC860000-0x00000252CC882000-memory.dmp

Filesize
136KB

Download
memory/224-16-0x00007FF8EE570000-0x00007FF8EF032000-memory.dmp

Filesize
10.8MB

Download
memory/224-15-0x00007FF8EE570000-0x00007FF8EF032000-memory.dmp

Filesize
10.8MB

Download
memory/224-12-0x00007FF8EE570000-0x00007FF8EF032000-memory.dmp

Filesize
10.8MB

Download
memory/224-11-0x00007FF8EE570000-0x00007FF8EF032000-memory.dmp

Filesize
10.8MB

Download
memory/6140-0-0x00007FF8EE573000-0x00007FF8EE575000-memory.dmp

Filesize
8KB

Download
memory/6140-1-0x0000000000350000-0x0000000000374000-memory.dmp

Filesize
144KB

Download
memory/6140-52-0x00007FF8EE570000-0x00007FF8EF032000-memory.dmp

Filesize
10.8MB

Download
memory/6140-53-0x00007FF8EE573000-0x00007FF8EE575000-memory.dmp

Filesize
8KB

Download
memory/6140-54-0x00007FF8EE570000-0x00007FF8EF032000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing