xworm | 1470a3336049aa3867b95b23f2671b64eebf2c79fbde95e860c6f592da96d0f7 | Triage

Analysis

max time kernel
1791s
max time network
1794s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
03-12-2024 15:44

Sharing

Report Analysis Logs

General

Target

rat-virus-DONT-INSTALL-main/ratka_dontopen.exe
Size

197KB
MD5

f43a0c44fc8034439cb6227eb7cfc9f0
SHA1

f1c2414c2a7dfe30245f07f430f3987da627be7b
SHA256

528f537709cc8c2d396961a07f2a264b3ba348db1ab7e6a8d096e7774d7c807b
SHA512

db6e1682d7116113189fd362a388e810e4604964b7250c91a87930918670bae11d84705535ec08b1fcdec4f8066f8b527281fb5ba56f04d940bbf94428b51dcf
SSDEEP

3072:Gne8nSoMNH4kbhuM6+OJSA2ewhLapuvpAsZOyMqmyBeYVYn:Gne8SXlb0a/GWGwqqm1

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

saw-proceedings.gl.at.ply.gg:16297

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral7/memory/3380-1-0x0000000000BD0000-0x0000000000C08000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

ratka_dontopen.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation	ratka_dontopen.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

ratka_dontopen.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ратка удали из авто загрузки! = "C:\\Users\\Admin\\AppData\\Roaming\\ратка удали из авто загрузки!"	ratka_dontopen.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

Processes:

schtasks.exe

pid	Process
2068	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ratka_dontopen.exe

description	pid	Process
Token: SeDebugPrivilege	3380	ratka_dontopen.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

ratka_dontopen.exe

description	pid	Process	procid_target
PID 3380 wrote to memory of 2068	3380	ratka_dontopen.exe	84
PID 3380 wrote to memory of 2068	3380	ratka_dontopen.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\rat-virus-DONT-INSTALL-main\ratka_dontopen.exe
"C:\Users\Admin\AppData\Local\Temp\rat-virus-DONT-INSTALL-main\ratka_dontopen.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "ратка удали из авто загрузки!" /tr "C:\Users\Admin\AppData\Roaming\ратка удали из авто загрузки!"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3380-0-0x00007FFCC9803000-0x00007FFCC9805000-memory.dmp

Filesize
8KB

Download
memory/3380-1-0x0000000000BD0000-0x0000000000C08000-memory.dmp

Filesize
224KB

Download
memory/3380-3-0x00007FFCC9800000-0x00007FFCCA2C2000-memory.dmp

Filesize
10.8MB

Download
memory/3380-4-0x00007FFCC9803000-0x00007FFCC9805000-memory.dmp

Filesize
8KB

Download
memory/3380-5-0x00007FFCC9800000-0x00007FFCCA2C2000-memory.dmp

Filesize
10.8MB

Download