xworm | 17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213

General

Target

17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe
Size

74KB
MD5

cdeaf8412bd8a931e78dd431b3452854
SHA1

27e36f2fe61f25f488f96bca51c80cc6e4954d0e
SHA256

17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213
SHA512

654b6469c0f2caa02e9effdb5eac73921bd04a01531e6a33264e57a53aad8a5c07c1da5459cf699864662cbe23ce8e5b72d12ff308826d4f31f0a6b3ea317e9d
SSDEEP

1536:YaoOInO4f0bgcPLQ+2HUx1F6znOOi0gYvl3FHJ:toJnDcbXzr2HfOOi0gYNFHJ

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

price-slow.gl.at.ply.gg:28067

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2340-1-0x00000000002E0000-0x00000000002F8000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2864	powershell.exe
2656	powershell.exe
2184	powershell.exe
2704	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2184	powershell.exe
2704	powershell.exe
2864	powershell.exe
2656	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2340	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe
Token: SeDebugPrivilege	2184	powershell.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	2340	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2184	2340	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe	31
PID 2340 wrote to memory of 2184	2340	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe	31
PID 2340 wrote to memory of 2184	2340	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe	31
PID 2340 wrote to memory of 2704	2340	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe	33
PID 2340 wrote to memory of 2704	2340	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe	33
PID 2340 wrote to memory of 2704	2340	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe	33
PID 2340 wrote to memory of 2864	2340	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe	35
PID 2340 wrote to memory of 2864	2340	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe	35
PID 2340 wrote to memory of 2864	2340	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe	35
PID 2340 wrote to memory of 2656	2340	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe	37
PID 2340 wrote to memory of 2656	2340	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe	37
PID 2340 wrote to memory of 2656	2340	17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe	37

C:\Users\Admin\AppData\Local\Temp\17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe
"C:\Users\Admin\AppData\Local\Temp\17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '17ec1863733680b6072ae31fc2476c1919c2a38176267df1f602218bd5dcf213.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
c16f353741a8039cc3dd798858464255

SHA1
fe54564a8fdf877ae279fd7476a1a31c67b77c21

SHA256
5d792127184443dd891e639dd6edb455b4575d10c67cc04b1be1f7dd9e7646a5

SHA512
621e8072570a301c7c2e8142fbb955a8dc904b4de04b59457fee8ebb9f960026c0e8019098b9f9646e9905cb1ca740a8fb22223f3fc13c7ae1a7832d67a65ae9

Download Submit
memory/2184-7-0x00000000021D0000-0x0000000002250000-memory.dmp

Filesize
512KB

Download
memory/2184-8-0x000000001B600000-0x000000001B8E2000-memory.dmp

Filesize
2.9MB

Download
memory/2184-9-0x00000000028E0000-0x00000000028E8000-memory.dmp

Filesize
32KB

Download
memory/2340-0-0x000007FEF58F3000-0x000007FEF58F4000-memory.dmp

Filesize
4KB

Download
memory/2340-1-0x00000000002E0000-0x00000000002F8000-memory.dmp

Filesize
96KB

Download
memory/2340-2-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp

Filesize
9.9MB

Download
memory/2340-17-0x000007FEF58F3000-0x000007FEF58F4000-memory.dmp

Filesize
4KB

Download
memory/2340-33-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp

Filesize
9.9MB

Download
memory/2704-15-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/2704-16-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads