xworm | fa71ca5766a5e57642af4006f1b240811e22fc5ff4df26d5edf994525814333d

Analysis

max time kernel
144s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
17-11-2024 14:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa71ca5766a5e57642af4006f1b240811e22fc5ff4df26d5edf994525814333d.exe
Size

287KB
MD5

8be246099b3ff1d9e8b2e2c14f6b286e
SHA1

b1e6b5dcb351d755fbc7abdd66f9228a597731cb
SHA256

fa71ca5766a5e57642af4006f1b240811e22fc5ff4df26d5edf994525814333d
SHA512

08501fd417f39764b0633ef86aea0adf05ffb239f48f99b10cc34dd6ca76cfe3c86a33b690a99c71aafbcf059f620653144a229e2dcd3ec93b4c242821f09ca0
SSDEEP

6144:JtjL9PYIoG/hZbv5NziERtMyXbkurBIuPnBTtr2PG/i4K:JtjyIoG/PbvLziERu2VrBI6nBTJ1m

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

127.0.0.1:7000

Mutex

FDifYDumKCtsXZEN

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000700000001956c-7.dat	family_xworm
behavioral1/memory/2212-8-0x0000000000320000-0x000000000032E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Executes dropped EXE 1 IoCs

pid	Process
2212	XClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2212	XClient.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2296	2320	fa71ca5766a5e57642af4006f1b240811e22fc5ff4df26d5edf994525814333d.exe	29
PID 2320 wrote to memory of 2296	2320	fa71ca5766a5e57642af4006f1b240811e22fc5ff4df26d5edf994525814333d.exe	29
PID 2320 wrote to memory of 2296	2320	fa71ca5766a5e57642af4006f1b240811e22fc5ff4df26d5edf994525814333d.exe	29
PID 2320 wrote to memory of 2212	2320	fa71ca5766a5e57642af4006f1b240811e22fc5ff4df26d5edf994525814333d.exe	30
PID 2320 wrote to memory of 2212	2320	fa71ca5766a5e57642af4006f1b240811e22fc5ff4df26d5edf994525814333d.exe	30
PID 2320 wrote to memory of 2212	2320	fa71ca5766a5e57642af4006f1b240811e22fc5ff4df26d5edf994525814333d.exe	30
PID 2296 wrote to memory of 3044	2296	rundll32.exe	31
PID 2296 wrote to memory of 3044	2296	rundll32.exe	31
PID 2296 wrote to memory of 3044	2296	rundll32.exe	31
PID 3044 wrote to memory of 2884	3044	rundll32.exe	32
PID 3044 wrote to memory of 2884	3044	rundll32.exe	32
PID 3044 wrote to memory of 2884	3044	rundll32.exe	32
PID 2884 wrote to memory of 2652	2884	rundll32.exe	33
PID 2884 wrote to memory of 2652	2884	rundll32.exe	33
PID 2884 wrote to memory of 2652	2884	rundll32.exe	33
PID 2652 wrote to memory of 2716	2652	rundll32.exe	34
PID 2652 wrote to memory of 2716	2652	rundll32.exe	34
PID 2652 wrote to memory of 2716	2652	rundll32.exe	34
PID 2716 wrote to memory of 2720	2716	rundll32.exe	35
PID 2716 wrote to memory of 2720	2716	rundll32.exe	35
PID 2716 wrote to memory of 2720	2716	rundll32.exe	35
PID 2720 wrote to memory of 2156	2720	rundll32.exe	36
PID 2720 wrote to memory of 2156	2720	rundll32.exe	36
PID 2720 wrote to memory of 2156	2720	rundll32.exe	36
PID 2156 wrote to memory of 1740	2156	rundll32.exe	37
PID 2156 wrote to memory of 1740	2156	rundll32.exe	37
PID 2156 wrote to memory of 1740	2156	rundll32.exe	37
PID 1740 wrote to memory of 3020	1740	rundll32.exe	38
PID 1740 wrote to memory of 3020	1740	rundll32.exe	38
PID 1740 wrote to memory of 3020	1740	rundll32.exe	38
PID 3020 wrote to memory of 2904	3020	rundll32.exe	39
PID 3020 wrote to memory of 2904	3020	rundll32.exe	39
PID 3020 wrote to memory of 2904	3020	rundll32.exe	39
PID 2904 wrote to memory of 1080	2904	rundll32.exe	40
PID 2904 wrote to memory of 1080	2904	rundll32.exe	40
PID 2904 wrote to memory of 1080	2904	rundll32.exe	40
PID 1080 wrote to memory of 2728	1080	rundll32.exe	41
PID 1080 wrote to memory of 2728	1080	rundll32.exe	41
PID 1080 wrote to memory of 2728	1080	rundll32.exe	41
PID 2728 wrote to memory of 2836	2728	rundll32.exe	42
PID 2728 wrote to memory of 2836	2728	rundll32.exe	42
PID 2728 wrote to memory of 2836	2728	rundll32.exe	42
PID 2836 wrote to memory of 1952	2836	rundll32.exe	43
PID 2836 wrote to memory of 1952	2836	rundll32.exe	43
PID 2836 wrote to memory of 1952	2836	rundll32.exe	43
PID 1952 wrote to memory of 316	1952	rundll32.exe	45
PID 1952 wrote to memory of 316	1952	rundll32.exe	45
PID 1952 wrote to memory of 316	1952	rundll32.exe	45
PID 316 wrote to memory of 848	316	rundll32.exe	46
PID 316 wrote to memory of 848	316	rundll32.exe	46
PID 316 wrote to memory of 848	316	rundll32.exe	46
PID 848 wrote to memory of 2280	848	rundll32.exe	47
PID 848 wrote to memory of 2280	848	rundll32.exe	47
PID 848 wrote to memory of 2280	848	rundll32.exe	47
PID 2280 wrote to memory of 1764	2280	rundll32.exe	48
PID 2280 wrote to memory of 1764	2280	rundll32.exe	48
PID 2280 wrote to memory of 1764	2280	rundll32.exe	48
PID 1764 wrote to memory of 2032	1764	rundll32.exe	49
PID 1764 wrote to memory of 2032	1764	rundll32.exe	49
PID 1764 wrote to memory of 2032	1764	rundll32.exe	49
PID 2032 wrote to memory of 1988	2032	rundll32.exe	50
PID 2032 wrote to memory of 1988	2032	rundll32.exe	50
PID 2032 wrote to memory of 1988	2032	rundll32.exe	50
PID 1988 wrote to memory of 2544	1988	rundll32.exe	51

C:\Users\Admin\AppData\Local\Temp\fa71ca5766a5e57642af4006f1b240811e22fc5ff4df26d5edf994525814333d.exe
"C:\Users\Admin\AppData\Local\Temp\fa71ca5766a5e57642af4006f1b240811e22fc5ff4df26d5edf994525814333d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\q ไม้ยก100%.rar
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\q ไม้ยก100%.rar
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3044
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\q ไม้ยก100%.rar
      4⤵
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2884
    - - C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\q ไม้ยก100%.rar
        5⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2652
      - C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\q ไม้ยก100%.rar
        6⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2716
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\q ไม้ยก100%.rar
        7⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2720
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\q ไม้ยก100%.rar
        8⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2156
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\q ไม้ยก100%.rar
        9⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1740
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\q ไม้ยก100%.rar
        10⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3020
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\q ไม้ยก100%.rar
        11⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2904
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\q ไม้ยก100%.rar
        12⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1080
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\q ไม้ยก100%.rar
        13⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2728
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\q ไม้ยก100%.rar
        14⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2836
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\q ไม้ยก100%.rar
        15⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1952
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\q ไม้ยก100%.rar
        16⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:316
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\q ไม้ยก100%.rar
        17⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:848
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\q ไม้ยก100%.rar
        18⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2280
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\q ไม้ยก100%.rar
        19⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1764
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\q ไม้ยก100%.rar
        20⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2032
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\q ไม้ยก100%.rar
        21⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1988
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\q ไม้ยก100%.rar
        22⤵
        Modifies registry class
        
        PID:2544
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\q ไม้ยก100%.rar
        23⤵
        Modifies registry class
        
        PID:1484
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\q ไม้ยก100%.rar
        24⤵
        Modifies registry class
        
        PID:2588
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\q ไม้ยก100%.rar
        25⤵
        Modifies registry class
        
        PID:1964
- C:\Users\Admin\AppData\Roaming\XClient.exe
  "C:\Users\Admin\AppData\Roaming\XClient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\XClient.exe

Filesize
32KB

MD5
c8adc1201433e732c762f4cca0ef59d5

SHA1
0ef49322427eee1735d2cd943d645453edbbc173

SHA256
0a66ae70b388aaa6ca8228d829345728739b631586440672faf0f9dd894cb994

SHA512
8f5d476a637da21a37f6b160b7a6281bc2aa952905ef06a61aa8b2851c5edf67b1528a7c46b6295856751b79de079aa05aea371cb7211074adcd97b3e537295e

Download Submit
memory/2212-8-0x0000000000320000-0x000000000032E000-memory.dmp

Filesize
56KB

Download
memory/2320-0-0x000007FEF5AF3000-0x000007FEF5AF4000-memory.dmp

Filesize
4KB

Download
memory/2320-1-0x00000000013E0000-0x000000000142E000-memory.dmp

Filesize
312KB

Download