xworm | b31d01d8e826ea4773cd7cfdbfca3712287024c03463acb374b5040af27fae71 | Triage

Analysis

max time kernel
124s
max time network
138s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
18/11/2024, 02:40 UTC

Sharing

Report Analysis Logs

General

Target

b31d01d8e826ea4773cd7cfdbfca3712287024c03463acb374b5040af27fae71.exe
Size

39KB
MD5

640194b0d51307f362b74fd4a4a1761d
SHA1

8e623f6ba2c87803f079b85578289359d71c6c90
SHA256

b31d01d8e826ea4773cd7cfdbfca3712287024c03463acb374b5040af27fae71
SHA512

7631827a014041c8066e334584116db7a3320de4fbbae285c9c87bccc53381ddc525add1f031e5920e01450155aa22b1550de2725ff213ea9fbb3e5c26118dc2
SSDEEP

768:feMIxy4cStkT1MfdDtVISFp9ITOMhkbF:feMIxnmpM5X3Fp9ITOMiJ

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

perfect-invest.gl.at.ply.gg:61586

Mutex

vnCrrKpdlb0ooKNR

Attributes

Install_directory
%AppData%
install_file
svchost.exe
telegram
https://api.telegram.org/bot7602273147:AAGPHHPgO8DxUDOWK0ZCgtSD_Rua_8wVzrE/sendMessage?chat_id=6589427579

aes.plain

1
qmnE8hMd4jDLseeIFWe9Og==

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/840-1-0x0000000001330000-0x0000000001340000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	b31d01d8e826ea4773cd7cfdbfca3712287024c03463acb374b5040af27fae71.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	b31d01d8e826ea4773cd7cfdbfca3712287024c03463acb374b5040af27fae71.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	b31d01d8e826ea4773cd7cfdbfca3712287024c03463acb374b5040af27fae71.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
840	b31d01d8e826ea4773cd7cfdbfca3712287024c03463acb374b5040af27fae71.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	840	b31d01d8e826ea4773cd7cfdbfca3712287024c03463acb374b5040af27fae71.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
840	b31d01d8e826ea4773cd7cfdbfca3712287024c03463acb374b5040af27fae71.exe

C:\Users\Admin\AppData\Local\Temp\b31d01d8e826ea4773cd7cfdbfca3712287024c03463acb374b5040af27fae71.exe
"C:\Users\Admin\AppData\Local\Temp\b31d01d8e826ea4773cd7cfdbfca3712287024c03463acb374b5040af27fae71.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:840

Network

DNS

api.telegram.org

b31d01d8e826ea4773cd7cfdbfca3712287024c03463acb374b5040af27fae71.exe

Remote address:

8.8.8.8:53

Request

api.telegram.org

IN A

Response

api.telegram.org

IN A

149.154.167.220
DNS

perfect-invest.gl.at.ply.gg

b31d01d8e826ea4773cd7cfdbfca3712287024c03463acb374b5040af27fae71.exe

Remote address:

8.8.8.8:53

Request

perfect-invest.gl.at.ply.gg

IN A

Response

perfect-invest.gl.at.ply.gg

IN A

147.185.221.23

149.154.167.220:443

api.telegram.org

tls

b31d01d8e826ea4773cd7cfdbfca3712287024c03463acb374b5040af27fae71.exe

388 B
219 B
5
5
147.185.221.23:61586

perfect-invest.gl.at.ply.gg

b31d01d8e826ea4773cd7cfdbfca3712287024c03463acb374b5040af27fae71.exe

152 B
3
147.185.221.23:61586

perfect-invest.gl.at.ply.gg

b31d01d8e826ea4773cd7cfdbfca3712287024c03463acb374b5040af27fae71.exe

152 B
3
147.185.221.23:61586

perfect-invest.gl.at.ply.gg

b31d01d8e826ea4773cd7cfdbfca3712287024c03463acb374b5040af27fae71.exe

152 B
3
147.185.221.23:61586

perfect-invest.gl.at.ply.gg

b31d01d8e826ea4773cd7cfdbfca3712287024c03463acb374b5040af27fae71.exe

152 B
3
147.185.221.23:61586

perfect-invest.gl.at.ply.gg

b31d01d8e826ea4773cd7cfdbfca3712287024c03463acb374b5040af27fae71.exe

152 B
3

8.8.8.8:53

api.telegram.org

dns

b31d01d8e826ea4773cd7cfdbfca3712287024c03463acb374b5040af27fae71.exe

62 B
78 B
1
1

DNS Request

api.telegram.org

DNS Response

149.154.167.220
8.8.8.8:53

perfect-invest.gl.at.ply.gg

dns

b31d01d8e826ea4773cd7cfdbfca3712287024c03463acb374b5040af27fae71.exe

73 B
89 B
1
1

DNS Request

perfect-invest.gl.at.ply.gg

DNS Response

147.185.221.23

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/840-0-0x000007FEF5E03000-0x000007FEF5E04000-memory.dmp

Filesize
4KB

Download
memory/840-1-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/840-6-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmp

Filesize
9.9MB

Download
memory/840-7-0x000007FEF5E03000-0x000007FEF5E04000-memory.dmp

Filesize
4KB

Download
memory/840-8-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmp

Filesize
9.9MB

Download