xworm | ecebefa7efb2e6058bfcf6368b5abac893aec2092c2c975bc40dedf6869f4ebb

General

Target

ecebefa7efb2e6058bfcf6368b5abac893aec2092c2c975bc40dedf6869f4ebb.exe
Size

49KB
MD5

718cb27afcc862a09f8275b7e738be09
SHA1

38e11449118b1b54a44a1a09b40ea7547103ad8c
SHA256

ecebefa7efb2e6058bfcf6368b5abac893aec2092c2c975bc40dedf6869f4ebb
SHA512

616f239bddd665d777bfef42fce0adfd15aecaa2cdd96420ac9421c1589b08a75959a5539f8de9ef689a9826c8aa583ec1ff2401ac736232f84968b5a922ff67
SSDEEP

768:NPcxLY8x6plvTQRbglW0Lw1MTHWpC+eJsEYWgh8/XyizR1yg5LhtOMlAcqDD9uer:RrDVTcTvOCugqXyIug5PwJqwV

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:7772

13.71.91.225:7772

Mutex

Sapr6UBSh6DxjMnP

Attributes

Install_directory
%AppData%
install_file
XClient.exe
telegram
https://api.telegram.org/bot7585343577:AAHgS-QNhULHIXmK3EKIXWuMP2uRNZpJjd8/sendMessage?chat_id=5424396760

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\XClient.exe	family_xworm
behavioral1/memory/2088-7-0x0000000000FA0000-0x0000000000FB2000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

2268 powershell.exe
2680 powershell.exe
2956 powershell.exe
2652 powershell.exe

pid	process
2268	powershell.exe
2680	powershell.exe
2956	powershell.exe
2652	powershell.exe

Drops startup file 2 IoCs

Processes:

XClient.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe

Executes dropped EXE 1 IoCs

Processes:

XClient.exe

pid process

2088 XClient.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeXClient.exe

pid process

2268 powershell.exe
2680 powershell.exe
2956 powershell.exe
2652 powershell.exe
2088 XClient.exe

pid	process
2088	XClient.exe

flow	ioc
4	ip-api.com

pid	process
2268	powershell.exe
2680	powershell.exe
2956	powershell.exe
2652	powershell.exe
2088	XClient.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

XClient.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2088	XClient.exe
Token: SeDebugPrivilege	2268	powershell.exe
Token: SeDebugPrivilege	2680	powershell.exe
Token: SeDebugPrivilege	2956	powershell.exe
Token: SeDebugPrivilege	2652	powershell.exe
Token: SeDebugPrivilege	2088	XClient.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

XClient.exe

pid process

2088 XClient.exe

pid	process
2088	XClient.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

ecebefa7efb2e6058bfcf6368b5abac893aec2092c2c975bc40dedf6869f4ebb.exeXClient.exe

description	pid	process	target process
PID 2900 wrote to memory of 2088	2900	ecebefa7efb2e6058bfcf6368b5abac893aec2092c2c975bc40dedf6869f4ebb.exe	XClient.exe
PID 2900 wrote to memory of 2088	2900	ecebefa7efb2e6058bfcf6368b5abac893aec2092c2c975bc40dedf6869f4ebb.exe	XClient.exe
PID 2900 wrote to memory of 2088	2900	ecebefa7efb2e6058bfcf6368b5abac893aec2092c2c975bc40dedf6869f4ebb.exe	XClient.exe
PID 2088 wrote to memory of 2268	2088	XClient.exe	powershell.exe
PID 2088 wrote to memory of 2268	2088	XClient.exe	powershell.exe
PID 2088 wrote to memory of 2268	2088	XClient.exe	powershell.exe
PID 2088 wrote to memory of 2680	2088	XClient.exe	powershell.exe
PID 2088 wrote to memory of 2680	2088	XClient.exe	powershell.exe
PID 2088 wrote to memory of 2680	2088	XClient.exe	powershell.exe
PID 2088 wrote to memory of 2956	2088	XClient.exe	powershell.exe
PID 2088 wrote to memory of 2956	2088	XClient.exe	powershell.exe
PID 2088 wrote to memory of 2956	2088	XClient.exe	powershell.exe
PID 2088 wrote to memory of 2652	2088	XClient.exe	powershell.exe
PID 2088 wrote to memory of 2652	2088	XClient.exe	powershell.exe
PID 2088 wrote to memory of 2652	2088	XClient.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\ecebefa7efb2e6058bfcf6368b5abac893aec2092c2c975bc40dedf6869f4ebb.exe
"C:\Users\Admin\AppData\Local\Temp\ecebefa7efb2e6058bfcf6368b5abac893aec2092c2c975bc40dedf6869f4ebb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Users\Admin\AppData\Local\Temp\XClient.exe
  "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2268
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2680
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XClient.exe

Filesize
51KB

MD5
a2ec2f7a3c221f89e8af8241f6cd5662

SHA1
ba5d9ff0c3a8c4b571d85a1ae8fb559fcab89fd3

SHA256
d7f084d86011371cd5b8206708fd720f1ace9a2eea4c07cee00d9da3f95c9ae1

SHA512
e97b01b898bcc28b27079493235dded8f418f676fbb5e89212a502228af32025f8caf8dfdd67a8b8489c2881ca6ff7746917980accd1fd0613bc537e637aa42a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
8cba917b843ac8011fbea5dbea160cda

SHA1
98e4d420609da864ff9e7137e99857cfb3014904

SHA256
9bf3141076ee95e9bb594b5ba8f20985507b431e3f547f2caf47d2cb168de281

SHA512
81eb28bf49a3bcaa6d56c697a11a1e6b0a65c35d2a83dd9ea3acd17d285b90cf270d236c17eb37d5a0308a3df8d24ba9766804b5a4eabfb5b4463fdb65b869f0

Download Submit
memory/2088-10-0x000007FEF56D0000-0x000007FEF60BC000-memory.dmp

Filesize
9.9MB

Download
memory/2088-7-0x0000000000FA0000-0x0000000000FB2000-memory.dmp

Filesize
72KB

Download
memory/2088-9-0x000007FEF56D0000-0x000007FEF60BC000-memory.dmp

Filesize
9.9MB

Download
memory/2088-35-0x000007FEF56D0000-0x000007FEF60BC000-memory.dmp

Filesize
9.9MB

Download
memory/2088-40-0x000007FEF56D0000-0x000007FEF60BC000-memory.dmp

Filesize
9.9MB

Download
memory/2268-16-0x000000001B550000-0x000000001B832000-memory.dmp

Filesize
2.9MB

Download
memory/2268-17-0x0000000001E70000-0x0000000001E78000-memory.dmp

Filesize
32KB

Download
memory/2680-23-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/2680-24-0x00000000023A0000-0x00000000023A8000-memory.dmp

Filesize
32KB

Download
memory/2900-8-0x000007FEF56D0000-0x000007FEF60BC000-memory.dmp

Filesize
9.9MB

Download
memory/2900-0-0x000007FEF56D3000-0x000007FEF56D4000-memory.dmp

Filesize
4KB

Download
memory/2900-11-0x000007FEF56D0000-0x000007FEF60BC000-memory.dmp

Filesize
9.9MB

Download
memory/2900-1-0x0000000000AB0000-0x0000000000AC2000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads