xworm | 78886dd99890f1d9d9bcf8cd1a89c2bd0bb74d26e3693602cc7d33c3fd6ecbd4

General

Target

exe003.exe
Size

73KB
MD5

4cdcc052cbfa29daccd43389d7c5afd2
SHA1

c3bffb079f6b5bf2ef63b8e14d199b72b4be8ee2
SHA256

78886dd99890f1d9d9bcf8cd1a89c2bd0bb74d26e3693602cc7d33c3fd6ecbd4
SHA512

b580196f4f0cfb16a907c62c30d812e09d3fa664881d306b0337a149a67edcc3341de4fd9e316eacf2b33951ff972cf1b4e92cbaed561101532054729cfc1a4d
SSDEEP

1536:j7h1eEfP2SP5Ap55v/oI+bI5Nez7BC9z6jFpOObo0:sSP45J/Z+bKNQpOO80

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

22.ip.gl.ply.gg:37805

Attributes

Install_directory
%Temp%
install_file
svchost.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2748-1-0x0000000000200000-0x0000000000218000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3016	powershell.exe
2768	powershell.exe
3012	powershell.exe
2672	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	exe003.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	exe003.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe"	exe003.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3016	powershell.exe
2768	powershell.exe
3012	powershell.exe
2672	powershell.exe
2748	exe003.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2748	exe003.exe
Token: SeDebugPrivilege	3016	powershell.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeDebugPrivilege	3012	powershell.exe
Token: SeDebugPrivilege	2672	powershell.exe
Token: SeDebugPrivilege	2748	exe003.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2748	exe003.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 3016	2748	exe003.exe	30
PID 2748 wrote to memory of 3016	2748	exe003.exe	30
PID 2748 wrote to memory of 3016	2748	exe003.exe	30
PID 2748 wrote to memory of 2768	2748	exe003.exe	32
PID 2748 wrote to memory of 2768	2748	exe003.exe	32
PID 2748 wrote to memory of 2768	2748	exe003.exe	32
PID 2748 wrote to memory of 3012	2748	exe003.exe	34
PID 2748 wrote to memory of 3012	2748	exe003.exe	34
PID 2748 wrote to memory of 3012	2748	exe003.exe	34
PID 2748 wrote to memory of 2672	2748	exe003.exe	36
PID 2748 wrote to memory of 2672	2748	exe003.exe	36
PID 2748 wrote to memory of 2672	2748	exe003.exe	36

C:\Users\Admin\AppData\Local\Temp\exe003.exe
"C:\Users\Admin\AppData\Local\Temp\exe003.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\exe003.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'exe003.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
7a966b930bc641832f8708e13488d742

SHA1
0887a7722be467623bbcbbc38d0f22bddec0fea6

SHA256
74b5ec5a248be84dc0b91e3c424e1d1e0b4d9d910171fd76e122b5322c6f42c9

SHA512
e38083ba7fd40ac510d5a14506263858dfa4af7abef7c8b856563d28a363f0492337dd597dd0e392cff28825e7c2c56c5ff2c04e7bb2548e48b39b68bc952e59

Download Submit
memory/2748-0-0x000007FEF5AF3000-0x000007FEF5AF4000-memory.dmp

Filesize
4KB

Download
memory/2748-1-0x0000000000200000-0x0000000000218000-memory.dmp

Filesize
96KB

Download
memory/2748-32-0x000000001B210000-0x000000001B290000-memory.dmp

Filesize
512KB

Download
memory/2748-33-0x000007FEF5AF3000-0x000007FEF5AF4000-memory.dmp

Filesize
4KB

Download
memory/2748-34-0x000000001B210000-0x000000001B290000-memory.dmp

Filesize
512KB

Download
memory/2768-14-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

Filesize
2.9MB

Download
memory/2768-15-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/3016-6-0x00000000029B0000-0x0000000002A30000-memory.dmp

Filesize
512KB

Download
memory/3016-7-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/3016-8-0x00000000029A0000-0x00000000029A8000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads