xworm | d7f084d86011371cd5b8206708fd720f1ace9a2eea4c07cee00d9da3f95c9ae1

Analysis

max time kernel
6s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 09:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7f084d86011371cd5b8206708fd720f1ace9a2eea4c07cee00d9da3f95c9ae1.exe
Size

51KB
MD5

a2ec2f7a3c221f89e8af8241f6cd5662
SHA1

ba5d9ff0c3a8c4b571d85a1ae8fb559fcab89fd3
SHA256

d7f084d86011371cd5b8206708fd720f1ace9a2eea4c07cee00d9da3f95c9ae1
SHA512

e97b01b898bcc28b27079493235dded8f418f676fbb5e89212a502228af32025f8caf8dfdd67a8b8489c2881ca6ff7746917980accd1fd0613bc537e637aa42a
SSDEEP

768:1qTF41hqoKo8sDTO2QhFmp6F5PX9OaSp68OMh/3/C2gOMlAcqDD9ueqwx:1sOhqxdAa28FBF19jSp68OMl6DwJqwx

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

127.0.0.1:7772

13.71.91.225:7772

Mutex

Sapr6UBSh6DxjMnP

Attributes

Install_directory
%AppData%
install_file
XClient.exe
telegram
https://api.telegram.org/bot7585343577:AAHgS-QNhULHIXmK3EKIXWuMP2uRNZpJjd8/sendMessage?chat_id=5424396760

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2196-1-0x0000000000B50000-0x0000000000B62000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
2312	powershell.exe
1404	powershell.exe
1080	powershell.exe
2532	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
4	ip-api.com

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d7f084d86011371cd5b8206708fd720f1ace9a2eea4c07cee00d9da3f95c9ae1.exe

description	pid	Process
Token: SeDebugPrivilege	2196	d7f084d86011371cd5b8206708fd720f1ace9a2eea4c07cee00d9da3f95c9ae1.exe

C:\Users\Admin\AppData\Local\Temp\d7f084d86011371cd5b8206708fd720f1ace9a2eea4c07cee00d9da3f95c9ae1.exe
"C:\Users\Admin\AppData\Local\Temp\d7f084d86011371cd5b8206708fd720f1ace9a2eea4c07cee00d9da3f95c9ae1.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\d7f084d86011371cd5b8206708fd720f1ace9a2eea4c07cee00d9da3f95c9ae1.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'd7f084d86011371cd5b8206708fd720f1ace9a2eea4c07cee00d9da3f95c9ae1.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\S6LPDRAE427NDJPYJEYK.temp

Filesize
7KB

MD5
0331be7288054908ca88674c80e2b3dd

SHA1
3bbd7500da5f6b50e6cdc9fab8a5011647b8e0a2

SHA256
0a100db77f4f2a171aa1c8e124a8fb830c6da3d9ee31fcf59702bc83aba34ae6

SHA512
056c41e5b8811b59f3ec457dafd17f56b1eaad4d94153bfd23292c359cd28701dd2e413cddb34391d5960b75fba9b585302f54318a96fb749ada03f160cc10f2

Download Submit
memory/2196-1-0x0000000000B50000-0x0000000000B62000-memory.dmp

Filesize
72KB

Download
memory/2196-0-0x000007FEF6473000-0x000007FEF6474000-memory.dmp

Filesize
4KB

Download
memory/2196-2-0x000007FEF6470000-0x000007FEF6E5C000-memory.dmp

Filesize
9.9MB

Download
memory/2196-31-0x000007FEF6473000-0x000007FEF6474000-memory.dmp

Filesize
4KB

Download
memory/2196-32-0x000007FEF6470000-0x000007FEF6E5C000-memory.dmp

Filesize
9.9MB

Download
memory/2312-7-0x00000000027B0000-0x0000000002830000-memory.dmp

Filesize
512KB

Download
memory/2312-9-0x00000000029A0000-0x00000000029A8000-memory.dmp

Filesize
32KB

Download
memory/2312-8-0x000000001B540000-0x000000001B822000-memory.dmp

Filesize
2.9MB

Download
memory/2532-15-0x000000001B600000-0x000000001B8E2000-memory.dmp

Filesize
2.9MB

Download
memory/2532-16-0x0000000001F00000-0x0000000001F08000-memory.dmp

Filesize
32KB

Download