xworm | bf1607227a4a2b909350b632acd33cd0daedf9dd00833f2f9c08c5b3722c4e61

General

Target

mapper.exe
Size

39KB
MD5

50a529bef7f33d9df03b08a8fb994e18
SHA1

2bf0691eb3397c7ef57bf890226bc94c9bb94e87
SHA256

bf1607227a4a2b909350b632acd33cd0daedf9dd00833f2f9c08c5b3722c4e61
SHA512

50823ec44867687e519f385da7014e4de21467baf24f023d8def581bc064bc1b72c7c3192bf6153168d7b2beb766cb32d2929ebd999d2e8f14036662354bd11a
SSDEEP

768:om7xQGttbzFKuGCuuJ/5c/dpfFWPJ92sn6dOMh+jlJm:om7xLXIrCuuJeHFe92sn6dOMMnm

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

chicago-thesis.gl.at.ply.gg:6667

Mutex

lKp2HLlCkTUSUHuZ

Attributes

Install_directory
%AppData%
install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2792-1-0x0000000000DB0000-0x0000000000DC0000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2588	powershell.exe
3000	powershell.exe
2572	powershell.exe
2952	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.lnk	mapper.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.lnk	mapper.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\discord = "C:\\Users\\Admin\\AppData\\Roaming\\discord"	mapper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2588	powershell.exe
3000	powershell.exe
2572	powershell.exe
2952	powershell.exe
2792	mapper.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2792	mapper.exe
Token: SeDebugPrivilege	2588	powershell.exe
Token: SeDebugPrivilege	3000	powershell.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	2792	mapper.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2792	mapper.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2588	2792	mapper.exe	28
PID 2792 wrote to memory of 2588	2792	mapper.exe	28
PID 2792 wrote to memory of 2588	2792	mapper.exe	28
PID 2792 wrote to memory of 3000	2792	mapper.exe	30
PID 2792 wrote to memory of 3000	2792	mapper.exe	30
PID 2792 wrote to memory of 3000	2792	mapper.exe	30
PID 2792 wrote to memory of 2572	2792	mapper.exe	32
PID 2792 wrote to memory of 2572	2792	mapper.exe	32
PID 2792 wrote to memory of 2572	2792	mapper.exe	32
PID 2792 wrote to memory of 2952	2792	mapper.exe	34
PID 2792 wrote to memory of 2952	2792	mapper.exe	34
PID 2792 wrote to memory of 2952	2792	mapper.exe	34

C:\Users\Admin\AppData\Local\Temp\mapper.exe
"C:\Users\Admin\AppData\Local\Temp\mapper.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\mapper.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'mapper.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\discord'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'discord'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
e5e8537f67db37634461eaa07d70d1ee

SHA1
03e4b8fb6e9fb73b56b9d0a5924df05fcc367fe5

SHA256
b2ff817731310561945f052c8192fc0f0a1a77ddad9ebb8a60e90375a4e08b19

SHA512
c3e01b3ec606dc3106d338a6384bf2ac3f0e9c3ec033bb34a1e1401b839b842ac741df730a5a4df2a10dcad23e942e83adc8e506a839007dd860de175b1e5dc1

Download Submit
memory/2588-6-0x0000000002BF0000-0x0000000002C70000-memory.dmp

Filesize
512KB

Download
memory/2588-7-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

Filesize
2.9MB

Download
memory/2588-8-0x0000000002690000-0x0000000002698000-memory.dmp

Filesize
32KB

Download
memory/2792-0-0x000007FEF6353000-0x000007FEF6354000-memory.dmp

Filesize
4KB

Download
memory/2792-1-0x0000000000DB0000-0x0000000000DC0000-memory.dmp

Filesize
64KB

Download
memory/2792-30-0x000000001B410000-0x000000001B490000-memory.dmp

Filesize
512KB

Download
memory/2792-31-0x000007FEF6353000-0x000007FEF6354000-memory.dmp

Filesize
4KB

Download
memory/2792-32-0x000000001B410000-0x000000001B490000-memory.dmp

Filesize
512KB

Download
memory/3000-14-0x000000001B580000-0x000000001B862000-memory.dmp

Filesize
2.9MB

Download
memory/3000-15-0x0000000001E60000-0x0000000001E68000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads