xworm | 1470a3336049aa3867b95b23f2671b64eebf2c79fbde95e860c6f592da96d0f7 | Triage

Analysis

max time kernel
1786s
max time network
1795s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
03/12/2024, 15:44

Sharing

Report Analysis Logs

General

Target

rat-virus-DONT-INSTALL-main/gfdgdf.exe
Size

196KB
MD5

f1d574a2ce3b45d46845424deb8a40c4
SHA1

eb9001eb8a7c84b8c098e5272e019749212ef6ce
SHA256

b6af30ae56cde74bd4cbdce14c37fbf9926be55f461915b7520c27276b8a1d2e
SHA512

4cddbb15335ad1257ecb99f67f48f9b925156cdea9a8a4aaeda3e7d738109553fb9e1372e7b06cf4249e3275a988a031889cf1b2d139b455b85932e657390e05
SSDEEP

3072:I+o5f+Rd3SfgCkb0PYfUjgOy8A2ewhLapuvpAsZOyMqmyBeYVYO:I+o5fWdiqbjfUD/GWGwqqm1

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

saw-proceedings.gl.at.ply.gg:7021

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral3/memory/4832-1-0x0000000000010000-0x0000000000048000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation	gfdgdf.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ратка удали из авто загрузки! = "C:\\Users\\Admin\\AppData\\Roaming\\ратка удали из авто загрузки!"	gfdgdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3300	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4832	gfdgdf.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 3300	4832	gfdgdf.exe	81
PID 4832 wrote to memory of 3300	4832	gfdgdf.exe	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\rat-virus-DONT-INSTALL-main\gfdgdf.exe
"C:\Users\Admin\AppData\Local\Temp\rat-virus-DONT-INSTALL-main\gfdgdf.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "ратка удали из авто загрузки!" /tr "C:\Users\Admin\AppData\Roaming\ратка удали из авто загрузки!"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4832-0-0x00007FFEE45B3000-0x00007FFEE45B5000-memory.dmp

Filesize
8KB

Download
memory/4832-1-0x0000000000010000-0x0000000000048000-memory.dmp

Filesize
224KB

Download
memory/4832-3-0x00007FFEE45B0000-0x00007FFEE5072000-memory.dmp

Filesize
10.8MB

Download
memory/4832-4-0x00007FFEE45B3000-0x00007FFEE45B5000-memory.dmp

Filesize
8KB

Download
memory/4832-5-0x00007FFEE45B0000-0x00007FFEE5072000-memory.dmp

Filesize
10.8MB

Download