xworm | 17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213

General

Target

17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe
Size

74KB
MD5

cdeaf8412bd8a931e78dd431b3452854
SHA1

27e36f2fe61f25f488f96bca51c80cc6e4954d0e
SHA256

17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213
SHA512

654b6469c0f2caa02e9effdb5eac73921bd04a01531e6a33264e57a53aad8a5c07c1da5459cf699864662cbe23ce8e5b72d12ff308826d4f31f0a6b3ea317e9d
SSDEEP

1536:YaoOInO4f0bgcPLQ+2HUx1F6znOOi0gYvl3FHJ:toJnDcbXzr2HfOOi0gYNFHJ

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

price-slow.gl.at.ply.gg:28067

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1564-1-0x0000000000D20000-0x0000000000D38000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2768	powershell.exe
2980	powershell.exe
2532	powershell.exe
2912	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2980	powershell.exe
2532	powershell.exe
2912	powershell.exe
2768	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1564	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe
Token: SeDebugPrivilege	2980	powershell.exe
Token: SeDebugPrivilege	2532	powershell.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeDebugPrivilege	1564	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 2980	1564	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe	30
PID 1564 wrote to memory of 2980	1564	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe	30
PID 1564 wrote to memory of 2980	1564	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe	30
PID 1564 wrote to memory of 2532	1564	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe	32
PID 1564 wrote to memory of 2532	1564	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe	32
PID 1564 wrote to memory of 2532	1564	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe	32
PID 1564 wrote to memory of 2912	1564	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe	34
PID 1564 wrote to memory of 2912	1564	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe	34
PID 1564 wrote to memory of 2912	1564	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe	34
PID 1564 wrote to memory of 2768	1564	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe	36
PID 1564 wrote to memory of 2768	1564	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe	36
PID 1564 wrote to memory of 2768	1564	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe	36

C:\Users\Admin\AppData\Local\Temp\17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe
"C:\Users\Admin\AppData\Local\Temp\17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
11d621f8bcdae922abe5b6c7b00d53b6

SHA1
1e698fa47fec985164a6602fe2e73d426eb82c35

SHA256
34dfe5cb7306e690df885c2b20f8480e06462a11be6893bf754ce35e325559b6

SHA512
9dba6a9e46952b16bf1523fa432322d6ac3cadd08bcff3456de4b07f806cac9f217f430e5b4183904c3bafa53434b77947fbf5db7016b68e9fe7521f493699e7

Download Submit
memory/1564-0-0x000007FEF57E3000-0x000007FEF57E4000-memory.dmp

Filesize
4KB

Download
memory/1564-1-0x0000000000D20000-0x0000000000D38000-memory.dmp

Filesize
96KB

Download
memory/1564-2-0x000007FEF57E0000-0x000007FEF61CC000-memory.dmp

Filesize
9.9MB

Download
memory/1564-32-0x000007FEF57E0000-0x000007FEF61CC000-memory.dmp

Filesize
9.9MB

Download
memory/2532-15-0x000000001B700000-0x000000001B9E2000-memory.dmp

Filesize
2.9MB

Download
memory/2532-16-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/2980-7-0x0000000002BC0000-0x0000000002C40000-memory.dmp

Filesize
512KB

Download
memory/2980-8-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/2980-9-0x00000000027F0000-0x00000000027F8000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads