xworm | e19bbde43b68c0b2ab107adde791a74bdfd078fc6ac88df307e6a0cbee56b1da

General

Target

XClient.exe
Size

39KB
MD5

40fd2932a64ccfd8ad76a8ce81d557d5
SHA1

3e8f86b139ffb80a5425140d5ea08e149fae1b08
SHA256

e19bbde43b68c0b2ab107adde791a74bdfd078fc6ac88df307e6a0cbee56b1da
SHA512

35ebaf198dcc9071f163d89d0913fe1c0840ce4b28c6b9b15ab5710abb60c061c09e788565a6921c04a9975a7dd187fcdc4d03b6fc51dd09f944573dd3287679
SSDEEP

768:ZBj78fx6MooHKBjJfDUbtRFH9OKi6BOMh6L05jX:b78p6MLqBjJfIbDFH93i6BOMskjX

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:14333

previous-contests.gl.at.ply.gg:14333

Mutex

GH9VJU0DztsBgWNu

Attributes

Install_directory
%AppData%
install_file
XClient.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1804-1-0x0000000001010000-0x0000000001020000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
2924	powershell.exe
2644	powershell.exe
1636	powershell.exe
2144	powershell.exe

Drops startup file 2 IoCs

Processes:

XClient.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeXClient.exe

pid	Process
2924	powershell.exe
2644	powershell.exe
1636	powershell.exe
2144	powershell.exe
1804	XClient.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

XClient.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	1804	XClient.exe
Token: SeDebugPrivilege	2924	powershell.exe
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeDebugPrivilege	1636	powershell.exe
Token: SeDebugPrivilege	2144	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

XClient.exe

pid	Process
1804	XClient.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

XClient.exe

description	pid	Process	procid_target
PID 1804 wrote to memory of 2924	1804	XClient.exe	32
PID 1804 wrote to memory of 2924	1804	XClient.exe	32
PID 1804 wrote to memory of 2924	1804	XClient.exe	32
PID 1804 wrote to memory of 2644	1804	XClient.exe	34
PID 1804 wrote to memory of 2644	1804	XClient.exe	34
PID 1804 wrote to memory of 2644	1804	XClient.exe	34
PID 1804 wrote to memory of 1636	1804	XClient.exe	36
PID 1804 wrote to memory of 1636	1804	XClient.exe	36
PID 1804 wrote to memory of 1636	1804	XClient.exe	36
PID 1804 wrote to memory of 2144	1804	XClient.exe	38
PID 1804 wrote to memory of 2144	1804	XClient.exe	38
PID 1804 wrote to memory of 2144	1804	XClient.exe	38

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
10d331e40f271d96b389bf93bb4a513e

SHA1
8fb8adfdaf8bc0dfd2529dbc48be0189d78ce82e

SHA256
95eff713ae0f76964073425664da3ee0376eb284d3aca6e7c562bc1044a546d8

SHA512
df607097da008ef183e8e13edd8eea7c6c06c509b46a6780f419ff555f0be62cce4d817c0e44b5496a74beb8c06c875d778e997eb307eab3e28aad12eabfa511

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1804-0-0x000007FEF5B73000-0x000007FEF5B74000-memory.dmp

Filesize
4KB

Download
memory/1804-1-0x0000000001010000-0x0000000001020000-memory.dmp

Filesize
64KB

Download
memory/1804-2-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

Filesize
9.9MB

Download
memory/1804-33-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

Filesize
9.9MB

Download
memory/2644-15-0x000000001B7B0000-0x000000001BA92000-memory.dmp

Filesize
2.9MB

Download
memory/2644-16-0x0000000001D10000-0x0000000001D18000-memory.dmp

Filesize
32KB

Download
memory/2924-7-0x0000000002D50000-0x0000000002DD0000-memory.dmp

Filesize
512KB

Download
memory/2924-8-0x000000001B7E0000-0x000000001BAC2000-memory.dmp

Filesize
2.9MB

Download
memory/2924-9-0x0000000001D20000-0x0000000001D28000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads