xworm | 1470a3336049aa3867b95b23f2671b64eebf2c79fbde95e860c6f592da96d0f7 | Triage

Analysis

max time kernel
1785s
max time network
1795s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
03-12-2024 15:44

Sharing

Report Analysis Logs

General

Target

rat-virus-DONT-INSTALL-main/gfdgdf.exe
Size

196KB
MD5

f1d574a2ce3b45d46845424deb8a40c4
SHA1

eb9001eb8a7c84b8c098e5272e019749212ef6ce
SHA256

b6af30ae56cde74bd4cbdce14c37fbf9926be55f461915b7520c27276b8a1d2e
SHA512

4cddbb15335ad1257ecb99f67f48f9b925156cdea9a8a4aaeda3e7d738109553fb9e1372e7b06cf4249e3275a988a031889cf1b2d139b455b85932e657390e05
SSDEEP

3072:I+o5f+Rd3SfgCkb0PYfUjgOy8A2ewhLapuvpAsZOyMqmyBeYVYO:I+o5fWdiqbjfUD/GWGwqqm1

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

saw-proceedings.gl.at.ply.gg:7021

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1584-1-0x00000000001D0000-0x0000000000208000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\ратка удали из авто загрузки! = "C:\\Users\\Admin\\AppData\\Roaming\\ратка удали из авто загрузки!"	gfdgdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2588	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1584	gfdgdf.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 2588	1584	gfdgdf.exe	30
PID 1584 wrote to memory of 2588	1584	gfdgdf.exe	30
PID 1584 wrote to memory of 2588	1584	gfdgdf.exe	30

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\rat-virus-DONT-INSTALL-main\gfdgdf.exe
"C:\Users\Admin\AppData\Local\Temp\rat-virus-DONT-INSTALL-main\gfdgdf.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "ратка удали из авто загрузки!" /tr "C:\Users\Admin\AppData\Roaming\ратка удали из авто загрузки!"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2588

C:\Windows\system32\taskeng.exe
taskeng.exe {403A4A5F-BD10-4501-BE9A-53CAEE6FA8EC} S-1-5-21-1163522206-1469769407-485553996-1000:PJCSDMRP\Admin:Interactive:[1]
1⤵
PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1584-0-0x000007FEF53F3000-0x000007FEF53F4000-memory.dmp

Filesize
4KB

Download
memory/1584-1-0x00000000001D0000-0x0000000000208000-memory.dmp

Filesize
224KB

Download
memory/1584-3-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download
memory/1584-4-0x000007FEF53F3000-0x000007FEF53F4000-memory.dmp

Filesize
4KB

Download
memory/1584-5-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

Filesize
9.9MB

Download