xworm | 49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6

General

Target

49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe
Size

50KB
MD5

d08c6251a4242a295b2b12f099d11670
SHA1

11c079d31ebf1732fbe65f83a0be15202478967f
SHA256

49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6
SHA512

ba74639a5e7ae6add2a28ab4c15067ce77f241805a102356759bc1fbb032f89c56bfb44c9d7cdcbfcc1782d64e012859b10559d7e8b81aab894e6cc66fd2ddce
SSDEEP

1536:0Q1Zw+K5/jjV6wTO+bOekp4G60r0MOT/LgF:e5bjMz+bOIA/OTTgF

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

24.ip.gl.ply.gg:12722

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3720-1-0x00000000001B0000-0x00000000001C2000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
4424	powershell.exe
1832	powershell.exe
1764	powershell.exe
4008	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe

Drops startup file 2 IoCs

Processes:

49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe

pid	Process
4424	powershell.exe
4424	powershell.exe
1832	powershell.exe
1832	powershell.exe
1764	powershell.exe
1764	powershell.exe
4008	powershell.exe
4008	powershell.exe
3720	49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	3720	49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe
Token: SeDebugPrivilege	4424	powershell.exe
Token: SeDebugPrivilege	1832	powershell.exe
Token: SeDebugPrivilege	1764	powershell.exe
Token: SeDebugPrivilege	4008	powershell.exe
Token: SeDebugPrivilege	3720	49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe

pid	Process
3720	49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe

description	pid	Process	procid_target
PID 3720 wrote to memory of 4424	3720	49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe	84
PID 3720 wrote to memory of 4424	3720	49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe	84
PID 3720 wrote to memory of 1832	3720	49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe	86
PID 3720 wrote to memory of 1832	3720	49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe	86
PID 3720 wrote to memory of 1764	3720	49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe	88
PID 3720 wrote to memory of 1764	3720	49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe	88
PID 3720 wrote to memory of 4008	3720	49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe	90
PID 3720 wrote to memory of 4008	3720	49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe	90

C:\Users\Admin\AppData\Local\Temp\49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe
"C:\Users\Admin\AppData\Local\Temp\49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '49dd5def78f486c8827daa85c840cee3c4292595c634af94780f05993d9128c6.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
75d224e238a397659d8e5cf458a41143

SHA1
d182d16283d3d864a2e328b677551428c29ad6df

SHA256
6a98fa5e6c5b77722f2bd8c855fd14d6bf545fc35b292252d1dc136b89ed2fee

SHA512
3477f3b4182ffdccc817de4242c8fcba706c193a0de5170cd023f8df3d330487d7e372556524b5a0fe1df56de40923700f3f8368eadf6601970e347cbcf078cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cc19bcff372d20459d3651ba8aef50e7

SHA1
3c6f1d4cdd647864fb97a16b1aefba67fcee11f7

SHA256
366473e774d8976c7fd4dc582220666fb61a4feb3f7c95e69b2a68ad9e446ec9

SHA512
a0e360ca4b6e874fd44612bf4b17f3722c0619da4f6bade12a62efadae88c2d33460114eaafa2bc3fb1cef5bea07e745b8bee24f15d0cacaff5f4a521b225080

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gbd2lcif.qy1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3720-0-0x00007FFA5DF43000-0x00007FFA5DF45000-memory.dmp

Filesize
8KB

Download
memory/3720-1-0x00000000001B0000-0x00000000001C2000-memory.dmp

Filesize
72KB

Download
memory/3720-56-0x00007FFA5DF40000-0x00007FFA5EA01000-memory.dmp

Filesize
10.8MB

Download
memory/3720-57-0x00007FFA5DF43000-0x00007FFA5DF45000-memory.dmp

Filesize
8KB

Download
memory/3720-58-0x00007FFA5DF40000-0x00007FFA5EA01000-memory.dmp

Filesize
10.8MB

Download
memory/4424-13-0x00007FFA5DF40000-0x00007FFA5EA01000-memory.dmp

Filesize
10.8MB

Download
memory/4424-14-0x00007FFA5DF40000-0x00007FFA5EA01000-memory.dmp

Filesize
10.8MB

Download
memory/4424-17-0x00007FFA5DF40000-0x00007FFA5EA01000-memory.dmp

Filesize
10.8MB

Download
memory/4424-12-0x00007FFA5DF40000-0x00007FFA5EA01000-memory.dmp

Filesize
10.8MB

Download
memory/4424-2-0x000002924FFB0000-0x000002924FFD2000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads