xworm | d7f084d86011371cd5b8206708fd720f1ace9a2eea4c07cee00d9da3f95c9ae1

General

Target

d7f084d86011371cd5b8206708fd720f1ace9a2eea4c07cee00d9da3f95c9ae1.exe
Size

51KB
MD5

a2ec2f7a3c221f89e8af8241f6cd5662
SHA1

ba5d9ff0c3a8c4b571d85a1ae8fb559fcab89fd3
SHA256

d7f084d86011371cd5b8206708fd720f1ace9a2eea4c07cee00d9da3f95c9ae1
SHA512

e97b01b898bcc28b27079493235dded8f418f676fbb5e89212a502228af32025f8caf8dfdd67a8b8489c2881ca6ff7746917980accd1fd0613bc537e637aa42a
SSDEEP

768:1qTF41hqoKo8sDTO2QhFmp6F5PX9OaSp68OMh/3/C2gOMlAcqDD9ueqwx:1sOhqxdAa28FBF19jSp68OMl6DwJqwx

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:7772

13.71.91.225:7772

Mutex

Sapr6UBSh6DxjMnP

Attributes

Install_directory
%AppData%
install_file
XClient.exe
telegram
https://api.telegram.org/bot7585343577:AAHgS-QNhULHIXmK3EKIXWuMP2uRNZpJjd8/sendMessage?chat_id=5424396760

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1520-1-0x00000000001F0000-0x0000000000202000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
3724	powershell.exe
2524	powershell.exe
3076	powershell.exe
4124	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
13	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d7f084d86011371cd5b8206708fd720f1ace9a2eea4c07cee00d9da3f95c9ae1.exe

description	pid	Process
Token: SeDebugPrivilege	1520	d7f084d86011371cd5b8206708fd720f1ace9a2eea4c07cee00d9da3f95c9ae1.exe

C:\Users\Admin\AppData\Local\Temp\d7f084d86011371cd5b8206708fd720f1ace9a2eea4c07cee00d9da3f95c9ae1.exe
"C:\Users\Admin\AppData\Local\Temp\d7f084d86011371cd5b8206708fd720f1ace9a2eea4c07cee00d9da3f95c9ae1.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\d7f084d86011371cd5b8206708fd720f1ace9a2eea4c07cee00d9da3f95c9ae1.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'd7f084d86011371cd5b8206708fd720f1ace9a2eea4c07cee00d9da3f95c9ae1.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
a7e7cfd43d30bcc61251a5a230d79a7c

SHA1
0d5c054cc7a8a11b102ba68635e306799897ce28

SHA256
063bb7675f043bb4c1d78d5dc04801560331b0e430e7579d3a535740c539590f

SHA512
1fd8d7924a249fb3200dad3d5d9eda04b33f01bbb25579e71d541d6be97b0467338a28b0a8948223e357d6bf6b851f9fd9a2c38026002307ccf7a973f7ecbe83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
4b451bfff41491fbb65db7899b220e6e

SHA1
a80f200d4fa07d163f77edaf76ca88a13ae8b92e

SHA256
2460aaf397f756acea0d527e928a2633b6e947ce02a363cbb2288ec7dafd7e6b

SHA512
4e01c3bb07259f5e93ad6a98f97aaf20b32bc00d306bec76b235a0dbabc66cb29aebe568265dd3b44c9ad0fe31d2230029e88700498bb819b9ae22f2acd4b2f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ba169f4dcbbf147fe78ef0061a95e83b

SHA1
92a571a6eef49fff666e0f62a3545bcd1cdcda67

SHA256
5ef1421e19fde4bc03cd825dd7d6c0e7863f85fd8f0aa4a4d4f8d555dc7606d1

SHA512
8d2e5e552210dcda684682538bc964fdd8a8ff5b24cc2cc8af813729f0202191f98eb42d38d2355df17ae620fe401aad6ceaedaed3b112fdacd32485a3a0c07c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
04f1d68afbed6b13399edfae1e9b1472

SHA1
8bfdcb687a995e4a63a8c32df2c66dc89f91a8b0

SHA256
f358f33a42122e97c489fad7bbc8beab2eb42d42e4ec7fce0dd61fe6d8c0b8de

SHA512
30c5e72a8134992094d937d2588f7a503b1d6407d11afe0265b7c8b0ce14071925e5caed13fc4f9c28705df4c7aed3601f81b007048b148af274d7784aa5fb75

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gfgmh045.30a.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1520-0-0x00007FFCED2A3000-0x00007FFCED2A5000-memory.dmp

Filesize
8KB

Download
memory/1520-2-0x00007FFCED2A0000-0x00007FFCEDD61000-memory.dmp

Filesize
10.8MB

Download
memory/1520-1-0x00000000001F0000-0x0000000000202000-memory.dmp

Filesize
72KB

Download
memory/1520-58-0x00007FFCED2A0000-0x00007FFCEDD61000-memory.dmp

Filesize
10.8MB

Download
memory/1520-57-0x00007FFCED2A3000-0x00007FFCED2A5000-memory.dmp

Filesize
8KB

Download
memory/3724-12-0x00007FFCED2A0000-0x00007FFCEDD61000-memory.dmp

Filesize
10.8MB

Download
memory/3724-18-0x00007FFCED2A0000-0x00007FFCEDD61000-memory.dmp

Filesize
10.8MB

Download
memory/3724-15-0x00007FFCED2A0000-0x00007FFCEDD61000-memory.dmp

Filesize
10.8MB

Download
memory/3724-14-0x00007FFCED2A0000-0x00007FFCEDD61000-memory.dmp

Filesize
10.8MB

Download
memory/3724-13-0x000001E3746F0000-0x000001E374712000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads