xworm | 1470a3336049aa3867b95b23f2671b64eebf2c79fbde95e860c6f592da96d0f7 | Triage

Analysis

max time kernel
1795s
max time network
1800s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-12-2024 15:44

Sharing

Report Analysis Logs

General

Target

rat-virus-DONT-INSTALL-main/ratka_dontopen.exe
Size

197KB
MD5

f43a0c44fc8034439cb6227eb7cfc9f0
SHA1

f1c2414c2a7dfe30245f07f430f3987da627be7b
SHA256

528f537709cc8c2d396961a07f2a264b3ba348db1ab7e6a8d096e7774d7c807b
SHA512

db6e1682d7116113189fd362a388e810e4604964b7250c91a87930918670bae11d84705535ec08b1fcdec4f8066f8b527281fb5ba56f04d940bbf94428b51dcf
SSDEEP

3072:Gne8nSoMNH4kbhuM6+OJSA2ewhLapuvpAsZOyMqmyBeYVYn:Gne8SXlb0a/GWGwqqm1

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

saw-proceedings.gl.at.ply.gg:16297

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral5/memory/2760-1-0x0000000000390000-0x00000000003C8000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

ratka_dontopen.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\ратка удали из авто загрузки! = "C:\\Users\\Admin\\AppData\\Roaming\\ратка удали из авто загрузки!"	ratka_dontopen.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

Processes:

schtasks.exe

pid	Process
2208	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ratka_dontopen.exe

description	pid	Process
Token: SeDebugPrivilege	2760	ratka_dontopen.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ratka_dontopen.exe

description	pid	Process	procid_target
PID 2760 wrote to memory of 2208	2760	ratka_dontopen.exe	30
PID 2760 wrote to memory of 2208	2760	ratka_dontopen.exe	30
PID 2760 wrote to memory of 2208	2760	ratka_dontopen.exe	30

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\rat-virus-DONT-INSTALL-main\ratka_dontopen.exe
"C:\Users\Admin\AppData\Local\Temp\rat-virus-DONT-INSTALL-main\ratka_dontopen.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "ратка удали из авто загрузки!" /tr "C:\Users\Admin\AppData\Roaming\ратка удали из авто загрузки!"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2208

C:\Windows\system32\taskeng.exe
taskeng.exe {68C979A3-452F-4546-A6DF-31994A9AB95A} S-1-5-21-1846800975-3917212583-2893086201-1000:ZQABOPWE\Admin:Interactive:[1]
1⤵
PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2760-0-0x000007FEF6033000-0x000007FEF6034000-memory.dmp

Filesize
4KB

Download
memory/2760-1-0x0000000000390000-0x00000000003C8000-memory.dmp

Filesize
224KB

Download
memory/2760-3-0x000007FEF6030000-0x000007FEF6A1C000-memory.dmp

Filesize
9.9MB

Download
memory/2760-4-0x000007FEF6033000-0x000007FEF6034000-memory.dmp

Filesize
4KB

Download
memory/2760-5-0x000007FEF6030000-0x000007FEF6A1C000-memory.dmp

Filesize
9.9MB

Download