xworm | ba632368edb4e5751d72f276a1bc0d06dbd7b89a3583a5db09d3b39ee2576256

Analysis

max time kernel
110s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2024, 17:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bloxstrap-v2.8.1.exe
Size

11.1MB
MD5

98fe512e86a4d844618f4275cb11f9da
SHA1

42b6fcc6b481fa21bafd86c061c8592d327993cb
SHA256

ba632368edb4e5751d72f276a1bc0d06dbd7b89a3583a5db09d3b39ee2576256
SHA512

65d8f84dcb0c3971bb9c7930ba02e14ae05a62cf431576bcb8cb0de59f5a8c22decb7648481156a186d914410d914e69337d5069c7c5345bacaea2be94fc9659
SSDEEP

196608:ESHBLJKbIWxA63vYjVQ4SvrOXvH0RG1jT7ub1EBKnQtD794BY:BBVKNAGvcmTWUc1jT7FKny

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

192.168.68.139:2068

tell-outcome.gl.at.ply.gg:2068

Mutex

SXJOPv2u5QpF0aEa

Attributes

Install_directory
%AppData%
install_file
FileExplorer.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023c84-17.dat	family_xworm
behavioral2/memory/3500-25-0x0000000000660000-0x000000000066E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	Bloxstrap-v2.8.1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	Bloxstrap-v2.8.1.exe

Executes dropped EXE 2 IoCs

pid	Process
2040	Bloxstrap-v2.8.1.exe
3500	XClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FileExplorer = "C:\\Users\\Admin\\AppData\\Roaming\\FileExplorer.exe"	XClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3500	XClient.exe
Token: SeDebugPrivilege	2040	Bloxstrap-v2.8.1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2040	2536	Bloxstrap-v2.8.1.exe	82
PID 2536 wrote to memory of 2040	2536	Bloxstrap-v2.8.1.exe	82
PID 2536 wrote to memory of 3500	2536	Bloxstrap-v2.8.1.exe	83
PID 2536 wrote to memory of 3500	2536	Bloxstrap-v2.8.1.exe	83

C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.8.1.exe
"C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.8.1.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Users\Admin\AppData\Roaming\Bloxstrap-v2.8.1.exe
  "C:\Users\Admin\AppData\Roaming\Bloxstrap-v2.8.1.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2040
- C:\Users\Admin\AppData\Roaming\XClient.exe
  "C:\Users\Admin\AppData\Roaming\XClient.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:3500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Bloxstrap-v2.8.1.exe

Filesize
11.1MB

MD5
60246a70b28a9d7ef6a2dfe009e48075

SHA1
8dd51b8460307f785690008657918540a8ee4998

SHA256
e9091fa15944a451e792674cf408e400a5e6391cd31160040210b494bd723f17

SHA512
551ffebc64b11e21a234b3ac5a1e103e5cf0ff4fd4d5b71628d0c4215b24fbca946cc7dc14571667214dca86ae9c3327c928b996be456529f84bb2f4a0901e5f

Download Submit
C:\Users\Admin\AppData\Roaming\XClient.exe

Filesize
33KB

MD5
edd87a78e02a4c11c82bb8ccce9815d6

SHA1
a5c6753e71e4d4ad83325c60ec88780471297272

SHA256
da98f8de94a1f21adebde64bd45a11921fedeaec036035c46b80621b619f017b

SHA512
3bbdafa95291ac1df2fb4545f9f3818c1a5b817a4d6f3dde182a3996e71d2fd118df1447ddaf855c4432b8bdda454ae0aa26a31c4333785f87b744f34492a4cd

Download Submit
memory/2040-27-0x00007FFEB9EFB000-0x00007FFEB9EFC000-memory.dmp

Filesize
4KB

Download
memory/2536-0-0x00007FFEBCFA3000-0x00007FFEBCFA5000-memory.dmp

Filesize
8KB

Download
memory/2536-1-0x0000000000FE0000-0x0000000001B00000-memory.dmp

Filesize
11.1MB

Download
memory/3500-25-0x0000000000660000-0x000000000066E000-memory.dmp

Filesize
56KB

Download
memory/3500-26-0x00007FFEBCFA0000-0x00007FFEBDA61000-memory.dmp

Filesize
10.8MB

Download
memory/3500-29-0x000000001B3F0000-0x000000001B400000-memory.dmp

Filesize
64KB

Download
memory/3500-30-0x00007FFEBCFA0000-0x00007FFEBDA61000-memory.dmp

Filesize
10.8MB

Download
memory/3500-31-0x000000001B3F0000-0x000000001B400000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads