xworm | 0e24f1d56bc9acda5afb857fdb2c96ee295fd9b34efab29e95eae849367bd5de

General

Target

XClient.exe
Size

145KB
MD5

9ed864b6eaabf32d1fa70cc6b0c0c39c
SHA1

7c657049d6b5dd79d1937fb33abfd8f6d58e4a9a
SHA256

0e24f1d56bc9acda5afb857fdb2c96ee295fd9b34efab29e95eae849367bd5de
SHA512

759201eaf5f4da105badbbce6a5db8c32e2c8a05a7a09ab45fdae38bc8573b1a51f5cb3633260ceb8e33cba6917bc38b13c910d76398988a532976ef2b2eba34
SSDEEP

1536:kztwdf7oj8bdGdU3RTbfGhaKDcWS6JRQOVdIeBdFfw/joT3/4o:S2s2dGdixbfFKZRQOVWe1fw7oLX

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

afiffebri123-60395.portmap.io:60395

Attributes

Install_directory
%AppData%
install_file
XClient.exe
telegram
https://api.telegram.org/bot7486317179:AAEtNWUGA1lxUf1Hicy6OwAGMFiLZF8KznM/sendMessage?chat_id=1253599693

Signatures

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral1/memory/2960-1-0x00000000002C0000-0x00000000002EA000-memory.dmp	family_xworm
behavioral1/files/0x000b0000000120fb-34.dat	family_xworm
behavioral1/memory/1200-36-0x0000000001140000-0x000000000116A000-memory.dmp	family_xworm
behavioral1/memory/984-40-0x0000000001390000-0x00000000013BA000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2688	powershell.exe
2728	powershell.exe
3044	powershell.exe
2704	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe

Executes dropped EXE 3 IoCs

pid	Process
1200	XClient.exe
2060	XClient.exe
984	XClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	XClient.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2452	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2704	powershell.exe
2688	powershell.exe
2728	powershell.exe
3044	powershell.exe
2960	XClient.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2960	XClient.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeDebugPrivilege	3044	powershell.exe
Token: SeDebugPrivilege	2960	XClient.exe
Token: SeDebugPrivilege	1200	XClient.exe
Token: SeDebugPrivilege	2060	XClient.exe
Token: SeDebugPrivilege	984	XClient.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2960	XClient.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2704	2960	XClient.exe	31
PID 2960 wrote to memory of 2704	2960	XClient.exe	31
PID 2960 wrote to memory of 2704	2960	XClient.exe	31
PID 2960 wrote to memory of 2688	2960	XClient.exe	33
PID 2960 wrote to memory of 2688	2960	XClient.exe	33
PID 2960 wrote to memory of 2688	2960	XClient.exe	33
PID 2960 wrote to memory of 2728	2960	XClient.exe	35
PID 2960 wrote to memory of 2728	2960	XClient.exe	35
PID 2960 wrote to memory of 2728	2960	XClient.exe	35
PID 2960 wrote to memory of 3044	2960	XClient.exe	37
PID 2960 wrote to memory of 3044	2960	XClient.exe	37
PID 2960 wrote to memory of 3044	2960	XClient.exe	37
PID 2960 wrote to memory of 2452	2960	XClient.exe	39
PID 2960 wrote to memory of 2452	2960	XClient.exe	39
PID 2960 wrote to memory of 2452	2960	XClient.exe	39
PID 1896 wrote to memory of 1200	1896	taskeng.exe	43
PID 1896 wrote to memory of 1200	1896	taskeng.exe	43
PID 1896 wrote to memory of 1200	1896	taskeng.exe	43
PID 1896 wrote to memory of 2060	1896	taskeng.exe	44
PID 1896 wrote to memory of 2060	1896	taskeng.exe	44
PID 1896 wrote to memory of 2060	1896	taskeng.exe	44
PID 1896 wrote to memory of 984	1896	taskeng.exe	45
PID 1896 wrote to memory of 984	1896	taskeng.exe	45
PID 1896 wrote to memory of 984	1896	taskeng.exe	45

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3044
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2452

C:\Windows\system32\taskeng.exe
taskeng.exe {21334951-8797-4A2B-85CE-8716DE2D7B32} S-1-5-21-3551809350-4263495960-1443967649-1000:NNYJZAHP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Users\Admin\AppData\Roaming\XClient.exe
  C:\Users\Admin\AppData\Roaming\XClient.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1200
- C:\Users\Admin\AppData\Roaming\XClient.exe
  C:\Users\Admin\AppData\Roaming\XClient.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2060
- C:\Users\Admin\AppData\Roaming\XClient.exe
  C:\Users\Admin\AppData\Roaming\XClient.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
f5d5c40b10923920caafb5964017c973

SHA1
62aafa1a5a9103d397f6ecf46d7562b1d5b842a7

SHA256
6a70a8f5aa455fcce03c3718fd9607eac24765f8b801b8e254ddc16faa1a8caf

SHA512
87d78396031414e303a61cdd13043df8d8afd63e815becf80e4f59f6cbdadfef75328e7df859f917e8dc91f3d5401d4868634331a0f45bd7e10bd250726e3909

Download Submit
C:\Users\Admin\AppData\Roaming\XClient.exe

Filesize
145KB

MD5
9ed864b6eaabf32d1fa70cc6b0c0c39c

SHA1
7c657049d6b5dd79d1937fb33abfd8f6d58e4a9a

SHA256
0e24f1d56bc9acda5afb857fdb2c96ee295fd9b34efab29e95eae849367bd5de

SHA512
759201eaf5f4da105badbbce6a5db8c32e2c8a05a7a09ab45fdae38bc8573b1a51f5cb3633260ceb8e33cba6917bc38b13c910d76398988a532976ef2b2eba34

Download Submit
memory/984-40-0x0000000001390000-0x00000000013BA000-memory.dmp

Filesize
168KB

Download
memory/1200-36-0x0000000001140000-0x000000000116A000-memory.dmp

Filesize
168KB

Download
memory/2688-16-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download
memory/2688-15-0x000000001B600000-0x000000001B8E2000-memory.dmp

Filesize
2.9MB

Download
memory/2704-7-0x0000000002B00000-0x0000000002B80000-memory.dmp

Filesize
512KB

Download
memory/2704-9-0x0000000001E50000-0x0000000001E58000-memory.dmp

Filesize
32KB

Download
memory/2704-8-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/2960-22-0x000007FEF5663000-0x000007FEF5664000-memory.dmp

Filesize
4KB

Download
memory/2960-32-0x000007FEF5660000-0x000007FEF604C000-memory.dmp

Filesize
9.9MB

Download
memory/2960-0-0x000007FEF5663000-0x000007FEF5664000-memory.dmp

Filesize
4KB

Download
memory/2960-2-0x000007FEF5660000-0x000007FEF604C000-memory.dmp

Filesize
9.9MB

Download
memory/2960-1-0x00000000002C0000-0x00000000002EA000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads