xworm | 3f5c422fc745b9c39fb6933065f4da77b86b2956b52423e2bdbc5012d9df5ddf

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-12-2024 11:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f5c422fc745b9c39fb6933065f4da77b86b2956b52423e2bdbc5012d9df5ddfN.exe
Size

456KB
MD5

682e1c15b828ccfe593e5ce157bd58a0
SHA1

18e4aaf2ccc7e7b672ef041240588a0e4f1591a5
SHA256

3f5c422fc745b9c39fb6933065f4da77b86b2956b52423e2bdbc5012d9df5ddf
SHA512

5c9b59ff31e0f2705c711e0c09f2f30f98f68d147c7fdb0f621822873e00d917896e3c011844b234a2f43bd981ca8545a70e59b944cb1a8efcd6acbb292da553
SSDEEP

12288:Uh1Lk70TnvjcXiht42lGqxzSutAmdjoD9duJ7ye:wk70TrcSzljxugAmd8E

Score

10^/10

xworm discovery persistence rat trojan

Malware Config

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2528-1623-0x0000000005460000-0x0000000005472000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

3f5c422fc745b9c39fb6933065f4da77b86b2956b52423e2bdbc5012d9df5ddfN.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	3f5c422fc745b9c39fb6933065f4da77b86b2956b52423e2bdbc5012d9df5ddfN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

3f5c422fc745b9c39fb6933065f4da77b86b2956b52423e2bdbc5012d9df5ddfN.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3f5c422fc745b9c39fb6933065f4da77b86b2956b52423e2bdbc5012d9df5ddfN.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

3f5c422fc745b9c39fb6933065f4da77b86b2956b52423e2bdbc5012d9df5ddfN.exe

description	pid	Process
Token: SeDebugPrivilege	2528	3f5c422fc745b9c39fb6933065f4da77b86b2956b52423e2bdbc5012d9df5ddfN.exe

C:\Users\Admin\AppData\Local\Temp\3f5c422fc745b9c39fb6933065f4da77b86b2956b52423e2bdbc5012d9df5ddfN.exe
"C:\Users\Admin\AppData\Local\Temp\3f5c422fc745b9c39fb6933065f4da77b86b2956b52423e2bdbc5012d9df5ddfN.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2528-0-0x0000000074C2E000-0x0000000074C2F000-memory.dmp

Filesize
4KB

Download
memory/2528-1-0x0000000004810000-0x00000000048B2000-memory.dmp

Filesize
648KB

Download
memory/2528-2-0x0000000074C20000-0x000000007530E000-memory.dmp

Filesize
6.9MB

Download
memory/2528-4-0x0000000074C20000-0x000000007530E000-memory.dmp

Filesize
6.9MB

Download
memory/2528-3-0x0000000074C20000-0x000000007530E000-memory.dmp

Filesize
6.9MB

Download
memory/2528-5-0x0000000002360000-0x0000000002400000-memory.dmp

Filesize
640KB

Download
memory/2528-6-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-19-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-7-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-33-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-51-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-9-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-11-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-13-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-15-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-17-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-21-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-29-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-47-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-69-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-67-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-65-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-63-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-61-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-59-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-57-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-55-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-53-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-49-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-45-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-43-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-41-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-39-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-37-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-35-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-31-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-27-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-25-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-23-0x0000000002360000-0x00000000023FB000-memory.dmp

Filesize
620KB

Download
memory/2528-1622-0x0000000074C20000-0x000000007530E000-memory.dmp

Filesize
6.9MB

Download
memory/2528-1623-0x0000000005460000-0x0000000005472000-memory.dmp

Filesize
72KB

Download
memory/2528-1625-0x0000000074C2E000-0x0000000074C2F000-memory.dmp

Filesize
4KB

Download
memory/2528-1626-0x0000000074C20000-0x000000007530E000-memory.dmp

Filesize
6.9MB

Download
memory/2528-1627-0x0000000074C20000-0x000000007530E000-memory.dmp

Filesize
6.9MB

Download
memory/2528-1628-0x0000000074C20000-0x000000007530E000-memory.dmp

Filesize
6.9MB

Download