xworm | ecebefa7efb2e6058bfcf6368b5abac893aec2092c2c975bc40dedf6869f4ebb

General

Target

ecebefa7efb2e6058bfcf6368b5abac893aec2092c2c975bc40dedf6869f4ebb.exe
Size

49KB
MD5

718cb27afcc862a09f8275b7e738be09
SHA1

38e11449118b1b54a44a1a09b40ea7547103ad8c
SHA256

ecebefa7efb2e6058bfcf6368b5abac893aec2092c2c975bc40dedf6869f4ebb
SHA512

616f239bddd665d777bfef42fce0adfd15aecaa2cdd96420ac9421c1589b08a75959a5539f8de9ef689a9826c8aa583ec1ff2401ac736232f84968b5a922ff67
SSDEEP

768:NPcxLY8x6plvTQRbglW0Lw1MTHWpC+eJsEYWgh8/XyizR1yg5LhtOMlAcqDD9uer:RrDVTcTvOCugqXyIug5PwJqwV

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:7772

13.71.91.225:7772

Mutex

Sapr6UBSh6DxjMnP

Attributes

Install_directory
%AppData%
install_file
XClient.exe
telegram
https://api.telegram.org/bot7585343577:AAHgS-QNhULHIXmK3EKIXWuMP2uRNZpJjd8/sendMessage?chat_id=5424396760

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\XClient.exe	family_xworm
behavioral2/memory/4884-15-0x00000000004A0000-0x00000000004B2000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

4420 powershell.exe
4872 powershell.exe
3672 powershell.exe
4244 powershell.exe

pid	process
4420	powershell.exe
4872	powershell.exe
3672	powershell.exe
4244	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ecebefa7efb2e6058bfcf6368b5abac893aec2092c2c975bc40dedf6869f4ebb.exeXClient.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	ecebefa7efb2e6058bfcf6368b5abac893aec2092c2c975bc40dedf6869f4ebb.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	XClient.exe

Drops startup file 2 IoCs

Processes:

XClient.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe

Executes dropped EXE 1 IoCs

Processes:

XClient.exe

pid process

4884 XClient.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4884	XClient.exe

flow	ioc
15	ip-api.com

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeXClient.exe

pid	process
4872	powershell.exe
4872	powershell.exe
3672	powershell.exe
3672	powershell.exe
4244	powershell.exe
4244	powershell.exe
4420	powershell.exe
4420	powershell.exe
4884	XClient.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

XClient.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4884	XClient.exe
Token: SeDebugPrivilege	4872	powershell.exe
Token: SeDebugPrivilege	3672	powershell.exe
Token: SeDebugPrivilege	4244	powershell.exe
Token: SeDebugPrivilege	4420	powershell.exe
Token: SeDebugPrivilege	4884	XClient.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

XClient.exe

pid process

4884 XClient.exe

pid	process
4884	XClient.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

ecebefa7efb2e6058bfcf6368b5abac893aec2092c2c975bc40dedf6869f4ebb.exeXClient.exe

description	pid	process	target process
PID 2588 wrote to memory of 4884	2588	ecebefa7efb2e6058bfcf6368b5abac893aec2092c2c975bc40dedf6869f4ebb.exe	XClient.exe
PID 2588 wrote to memory of 4884	2588	ecebefa7efb2e6058bfcf6368b5abac893aec2092c2c975bc40dedf6869f4ebb.exe	XClient.exe
PID 4884 wrote to memory of 4872	4884	XClient.exe	powershell.exe
PID 4884 wrote to memory of 4872	4884	XClient.exe	powershell.exe
PID 4884 wrote to memory of 3672	4884	XClient.exe	powershell.exe
PID 4884 wrote to memory of 3672	4884	XClient.exe	powershell.exe
PID 4884 wrote to memory of 4244	4884	XClient.exe	powershell.exe
PID 4884 wrote to memory of 4244	4884	XClient.exe	powershell.exe
PID 4884 wrote to memory of 4420	4884	XClient.exe	powershell.exe
PID 4884 wrote to memory of 4420	4884	XClient.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\ecebefa7efb2e6058bfcf6368b5abac893aec2092c2c975bc40dedf6869f4ebb.exe
"C:\Users\Admin\AppData\Local\Temp\ecebefa7efb2e6058bfcf6368b5abac893aec2092c2c975bc40dedf6869f4ebb.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Users\Admin\AppData\Local\Temp\XClient.exe
  "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4872
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4244
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0093819c829dd30c13746f256efba97f

SHA1
f095cbb1d10a54a91d7d341c4098d44973d3ec50

SHA256
5f936c252c9ed7d08d4a73b86230d9877173b44c36544f0b24eae3eb38617401

SHA512
72aac852de41473494d2263aa44dbabfb1f318f8a21ebdfe080c4a98b9288db07e9641a935d9a640b5e879f28a0560cae53bd4191ac94d315b87746e57e69af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
b51dc9e5ec3c97f72b4ca9488bbb4462

SHA1
5c1e8c0b728cd124edcacefb399bbd5e25b21bd3

SHA256
976f9534aa2976c85c2455bdde786a3f55d63aefdd40942eba1223c4c93590db

SHA512
0e5aa6cf64c535aefb833e5757b68e1094c87424abe2615a7d7d26b1b31eff358d12e36e75ca57fd690a9919b776600bf4c5c0e5a5df55366ba62238bdf3f280

Download Submit
C:\Users\Admin\AppData\Local\Temp\XClient.exe

Filesize
51KB

MD5
a2ec2f7a3c221f89e8af8241f6cd5662

SHA1
ba5d9ff0c3a8c4b571d85a1ae8fb559fcab89fd3

SHA256
d7f084d86011371cd5b8206708fd720f1ace9a2eea4c07cee00d9da3f95c9ae1

SHA512
e97b01b898bcc28b27079493235dded8f418f676fbb5e89212a502228af32025f8caf8dfdd67a8b8489c2881ca6ff7746917980accd1fd0613bc537e637aa42a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ttcjyea1.wmp.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2588-1-0x0000000000700000-0x0000000000712000-memory.dmp

Filesize
72KB

Download
memory/2588-13-0x00007FFFF8850000-0x00007FFFF9311000-memory.dmp

Filesize
10.8MB

Download
memory/2588-53-0x00007FFFF8850000-0x00007FFFF9311000-memory.dmp

Filesize
10.8MB

Download
memory/2588-0-0x00007FFFF8853000-0x00007FFFF8855000-memory.dmp

Filesize
8KB

Download
memory/4872-19-0x000001836EBE0000-0x000001836EC02000-memory.dmp

Filesize
136KB

Download
memory/4884-16-0x00007FFFF8850000-0x00007FFFF9311000-memory.dmp

Filesize
10.8MB

Download
memory/4884-15-0x00000000004A0000-0x00000000004B2000-memory.dmp

Filesize
72KB

Download
memory/4884-14-0x00007FFFF8850000-0x00007FFFF9311000-memory.dmp

Filesize
10.8MB

Download
memory/4884-69-0x00007FFFF8850000-0x00007FFFF9311000-memory.dmp

Filesize
10.8MB

Download
memory/4884-70-0x00007FFFF8850000-0x00007FFFF9311000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads