xworm | 0a279b10c9275eb70ef94843fc547db50eaf547ca08e68bb74d1f6e78e30c92d

General

Target

XClient.exe
Size

79KB
MD5

9201f8cf2c137f4803588d270d08c362
SHA1

e136c079f29364731b96e72752d95daaa2f7f831
SHA256

0a279b10c9275eb70ef94843fc547db50eaf547ca08e68bb74d1f6e78e30c92d
SHA512

294060a08512430755f76028fe881cf1ac63e07a34d3882ba1c672fc1d2c998a2a8ebc0109c162759dfe327e85d2b6b0d32867deffa769392975969e9f6a5067
SSDEEP

1536:C7+e+C/iiSeQ1oxACbS9zARGdwd60ZbhXOP6C0Ry:C7+2ihfquCbS9tYZb9OPdiy

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

147.185.221.23:38042

Attributes

Install_directory
%AppData%
install_file
SystemUser32.exe

Signatures

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral1/memory/2860-1-0x00000000002D0000-0x00000000002EA000-memory.dmp	family_xworm
behavioral1/files/0x000900000001211a-35.dat	family_xworm
behavioral1/memory/776-37-0x0000000001330000-0x000000000134A000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1604	powershell.exe
2632	powershell.exe
2700	powershell.exe
2092	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemUser32.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemUser32.lnk	XClient.exe

Executes dropped EXE 3 IoCs

pid	Process
776	SystemUser32.exe
1940	SystemUser32.exe
752	SystemUser32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemUser32 = "C:\\Users\\Admin\\AppData\\Roaming\\SystemUser32.exe"	XClient.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2652	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2092	powershell.exe
1604	powershell.exe
2632	powershell.exe
2700	powershell.exe
2860	XClient.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2860	XClient.exe
Token: SeDebugPrivilege	2092	powershell.exe
Token: SeDebugPrivilege	1604	powershell.exe
Token: SeDebugPrivilege	2632	powershell.exe
Token: SeDebugPrivilege	2700	powershell.exe
Token: SeDebugPrivilege	2860	XClient.exe
Token: SeDebugPrivilege	776	SystemUser32.exe
Token: SeDebugPrivilege	1940	SystemUser32.exe
Token: SeDebugPrivilege	752	SystemUser32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2860	XClient.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2092	2860	XClient.exe	29
PID 2860 wrote to memory of 2092	2860	XClient.exe	29
PID 2860 wrote to memory of 2092	2860	XClient.exe	29
PID 2860 wrote to memory of 1604	2860	XClient.exe	31
PID 2860 wrote to memory of 1604	2860	XClient.exe	31
PID 2860 wrote to memory of 1604	2860	XClient.exe	31
PID 2860 wrote to memory of 2632	2860	XClient.exe	33
PID 2860 wrote to memory of 2632	2860	XClient.exe	33
PID 2860 wrote to memory of 2632	2860	XClient.exe	33
PID 2860 wrote to memory of 2700	2860	XClient.exe	35
PID 2860 wrote to memory of 2700	2860	XClient.exe	35
PID 2860 wrote to memory of 2700	2860	XClient.exe	35
PID 2860 wrote to memory of 2652	2860	XClient.exe	37
PID 2860 wrote to memory of 2652	2860	XClient.exe	37
PID 2860 wrote to memory of 2652	2860	XClient.exe	37
PID 1876 wrote to memory of 776	1876	taskeng.exe	42
PID 1876 wrote to memory of 776	1876	taskeng.exe	42
PID 1876 wrote to memory of 776	1876	taskeng.exe	42
PID 1876 wrote to memory of 1940	1876	taskeng.exe	43
PID 1876 wrote to memory of 1940	1876	taskeng.exe	43
PID 1876 wrote to memory of 1940	1876	taskeng.exe	43
PID 1876 wrote to memory of 752	1876	taskeng.exe	44
PID 1876 wrote to memory of 752	1876	taskeng.exe	44
PID 1876 wrote to memory of 752	1876	taskeng.exe	44

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\SystemUser32.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SystemUser32.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "SystemUser32" /tr "C:\Users\Admin\AppData\Roaming\SystemUser32.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2652

C:\Windows\system32\taskeng.exe
taskeng.exe {9E52AB3E-E1CA-4AA2-9D46-5D68601092E4} S-1-5-21-1846800975-3917212583-2893086201-1000:ZQABOPWE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Users\Admin\AppData\Roaming\SystemUser32.exe
  C:\Users\Admin\AppData\Roaming\SystemUser32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:776
- C:\Users\Admin\AppData\Roaming\SystemUser32.exe
  C:\Users\Admin\AppData\Roaming\SystemUser32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1940
- C:\Users\Admin\AppData\Roaming\SystemUser32.exe
  C:\Users\Admin\AppData\Roaming\SystemUser32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1c58cd5bcb19d7bd01e3875780374803

SHA1
7853ef890f219369aa12e453488d8692f7df6b7b

SHA256
e6feb100d7d6923abcfc95c271243902cabea9fdaf07f2f35d94e88138b23071

SHA512
ef25486e3531679b4b761f7e14bfb44f677259e7fc34ee58a5943a19099412f3e3832aac1e858aa7b5b18b15c6e67c80f5fff59422a9968c2053ce6fcec669b1

Download Submit
C:\Users\Admin\AppData\Roaming\SystemUser32.exe

Filesize
79KB

MD5
9201f8cf2c137f4803588d270d08c362

SHA1
e136c079f29364731b96e72752d95daaa2f7f831

SHA256
0a279b10c9275eb70ef94843fc547db50eaf547ca08e68bb74d1f6e78e30c92d

SHA512
294060a08512430755f76028fe881cf1ac63e07a34d3882ba1c672fc1d2c998a2a8ebc0109c162759dfe327e85d2b6b0d32867deffa769392975969e9f6a5067

Download Submit
memory/776-37-0x0000000001330000-0x000000000134A000-memory.dmp

Filesize
104KB

Download
memory/1604-15-0x000000001B7D0000-0x000000001BAB2000-memory.dmp

Filesize
2.9MB

Download
memory/1604-16-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/2092-7-0x0000000002B00000-0x0000000002B80000-memory.dmp

Filesize
512KB

Download
memory/2092-8-0x000000001B3F0000-0x000000001B6D2000-memory.dmp

Filesize
2.9MB

Download
memory/2092-9-0x00000000027A0000-0x00000000027A8000-memory.dmp

Filesize
32KB

Download
memory/2860-2-0x000007FEF56D0000-0x000007FEF60BC000-memory.dmp

Filesize
9.9MB

Download
memory/2860-0-0x000007FEF56D3000-0x000007FEF56D4000-memory.dmp

Filesize
4KB

Download
memory/2860-28-0x000007FEF56D3000-0x000007FEF56D4000-memory.dmp

Filesize
4KB

Download
memory/2860-33-0x000007FEF56D0000-0x000007FEF60BC000-memory.dmp

Filesize
9.9MB

Download
memory/2860-1-0x00000000002D0000-0x00000000002EA000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads