xworm | 5e0fbebfe54253ec36ca1b69bb380e2568de6fb650185438068b77212ad6d23e

General

Target

XClient.exe
Size

71KB
MD5

4eee730e3f4cd1e6b1f2455dbf51f5b7
SHA1

c95911de37debd2e3df1c630ddeeac4968413296
SHA256

5e0fbebfe54253ec36ca1b69bb380e2568de6fb650185438068b77212ad6d23e
SHA512

7caf0d07acc752c16c29d77c4ae0c67163367435ec7fe6109ed1561f4c2320c9a54449e911d48d627606c822108fbe48b4193201adee5137015837359e1768f4
SSDEEP

1536:eV/fyQp7uAxurpTNgbRaKgjtqK6B64iS5O2x571t:eV/d7hot2bYDDlS5O2x3t

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

147.185.221.23:38042

Attributes

Install_directory
%AppData%
install_file
SystemUser32.exe

Signatures

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral1/memory/2464-1-0x0000000001360000-0x0000000001378000-memory.dmp	family_xworm
behavioral1/files/0x001000000001226d-35.dat	family_xworm
behavioral1/memory/1936-37-0x00000000010E0000-0x00000000010F8000-memory.dmp	family_xworm
behavioral1/memory/2960-40-0x0000000001370000-0x0000000001388000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2652	powershell.exe
2992	powershell.exe
2204	powershell.exe
2620	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemUser32.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemUser32.lnk	XClient.exe

Executes dropped EXE 2 IoCs

pid	Process
1936	SystemUser32.exe
2960	SystemUser32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemUser32 = "C:\\Users\\Admin\\AppData\\Roaming\\SystemUser32.exe"	XClient.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1860	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2652	powershell.exe
2992	powershell.exe
2204	powershell.exe
2620	powershell.exe
2464	XClient.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2464	XClient.exe
Token: SeDebugPrivilege	2652	powershell.exe
Token: SeDebugPrivilege	2992	powershell.exe
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeDebugPrivilege	2464	XClient.exe
Token: SeDebugPrivilege	1936	SystemUser32.exe
Token: SeDebugPrivilege	2960	SystemUser32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2464	XClient.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2652	2464	XClient.exe	32
PID 2464 wrote to memory of 2652	2464	XClient.exe	32
PID 2464 wrote to memory of 2652	2464	XClient.exe	32
PID 2464 wrote to memory of 2992	2464	XClient.exe	34
PID 2464 wrote to memory of 2992	2464	XClient.exe	34
PID 2464 wrote to memory of 2992	2464	XClient.exe	34
PID 2464 wrote to memory of 2204	2464	XClient.exe	36
PID 2464 wrote to memory of 2204	2464	XClient.exe	36
PID 2464 wrote to memory of 2204	2464	XClient.exe	36
PID 2464 wrote to memory of 2620	2464	XClient.exe	38
PID 2464 wrote to memory of 2620	2464	XClient.exe	38
PID 2464 wrote to memory of 2620	2464	XClient.exe	38
PID 2464 wrote to memory of 1860	2464	XClient.exe	40
PID 2464 wrote to memory of 1860	2464	XClient.exe	40
PID 2464 wrote to memory of 1860	2464	XClient.exe	40
PID 2444 wrote to memory of 1936	2444	taskeng.exe	43
PID 2444 wrote to memory of 1936	2444	taskeng.exe	43
PID 2444 wrote to memory of 1936	2444	taskeng.exe	43
PID 2444 wrote to memory of 2960	2444	taskeng.exe	45
PID 2444 wrote to memory of 2960	2444	taskeng.exe	45
PID 2444 wrote to memory of 2960	2444	taskeng.exe	45

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\SystemUser32.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SystemUser32.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2620
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "SystemUser32" /tr "C:\Users\Admin\AppData\Roaming\SystemUser32.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1860

C:\Windows\system32\taskeng.exe
taskeng.exe {7C3147D9-8071-4078-BD10-10434D00D050} S-1-5-21-1846800975-3917212583-2893086201-1000:ZQABOPWE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Users\Admin\AppData\Roaming\SystemUser32.exe
  C:\Users\Admin\AppData\Roaming\SystemUser32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1936
- C:\Users\Admin\AppData\Roaming\SystemUser32.exe
  C:\Users\Admin\AppData\Roaming\SystemUser32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1e1f95aa375ab8ead9f8320a11945352

SHA1
bb463ed23a42230ae62dd901f51571970bb2634c

SHA256
7238a87cc53d11b1f28752d5ab6e4849301e9acbc98d1dada67c6189bb4cef82

SHA512
d14ea6e12f16708736d517aeb47dbbeaec74b7411ad5937878f7f9c88ae2a81fb5784a705e408005fac0719e2a89d3ff591238bd78b263b823b63db72fe04a00

Download Submit
C:\Users\Admin\AppData\Roaming\SystemUser32.exe

Filesize
71KB

MD5
4eee730e3f4cd1e6b1f2455dbf51f5b7

SHA1
c95911de37debd2e3df1c630ddeeac4968413296

SHA256
5e0fbebfe54253ec36ca1b69bb380e2568de6fb650185438068b77212ad6d23e

SHA512
7caf0d07acc752c16c29d77c4ae0c67163367435ec7fe6109ed1561f4c2320c9a54449e911d48d627606c822108fbe48b4193201adee5137015837359e1768f4

Download Submit
memory/1936-37-0x00000000010E0000-0x00000000010F8000-memory.dmp

Filesize
96KB

Download
memory/2464-2-0x000007FEF5F80000-0x000007FEF696C000-memory.dmp

Filesize
9.9MB

Download
memory/2464-0-0x000007FEF5F83000-0x000007FEF5F84000-memory.dmp

Filesize
4KB

Download
memory/2464-28-0x000007FEF5F83000-0x000007FEF5F84000-memory.dmp

Filesize
4KB

Download
memory/2464-33-0x000007FEF5F80000-0x000007FEF696C000-memory.dmp

Filesize
9.9MB

Download
memory/2464-1-0x0000000001360000-0x0000000001378000-memory.dmp

Filesize
96KB

Download
memory/2652-7-0x0000000002D20000-0x0000000002DA0000-memory.dmp

Filesize
512KB

Download
memory/2652-8-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/2652-9-0x0000000002910000-0x0000000002918000-memory.dmp

Filesize
32KB

Download
memory/2960-40-0x0000000001370000-0x0000000001388000-memory.dmp

Filesize
96KB

Download
memory/2992-15-0x000000001B4C0000-0x000000001B7A2000-memory.dmp

Filesize
2.9MB

Download
memory/2992-16-0x0000000002620000-0x0000000002628000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads