xworm | 13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11

General

Target

13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe
Size

64KB
MD5

0893b12cf7899e969bc6d094f13395c0
SHA1

0fb0e47ae981a3fcb02a0f0c366f1754e9f05ff8
SHA256

13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11
SHA512

891edbc54976cadcdcdccd586be39e36fc297adf5b56fc09602d99700c45a01ceec363b6f2301100880666c682eb342bf48b5f0c33bc7004572be5a52aef447a
SSDEEP

1536:+EVRBKXfmrbLO+BBUsbJU5fRqw6LCLOO4wH:RVRwunLbHbJUNYoOOrH

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

disclaimer-hose.gl.at.ply.gg:11906

Attributes

Install_directory
%Userprofile%
install_file
Microsoft Edge.exe

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2196-1-0x00000000008A0000-0x00000000008B6000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
2228	powershell.exe
2824	powershell.exe
2620	powershell.exe
1096	powershell.exe

Drops startup file 2 IoCs

Processes:

13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.lnk	13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.lnk	13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Edge = "C:\\Users\\Admin\\Microsoft Edge.exe"	13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exe

pid	Process
2264	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe

pid	Process
2824	powershell.exe
2620	powershell.exe
1096	powershell.exe
2228	powershell.exe
2196	13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	2196	13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe
Token: SeDebugPrivilege	2824	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeDebugPrivilege	1096	powershell.exe
Token: SeDebugPrivilege	2228	powershell.exe
Token: SeDebugPrivilege	2196	13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe

pid	Process
2196	13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe

description	pid	Process	procid_target
PID 2196 wrote to memory of 2824	2196	13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe	31
PID 2196 wrote to memory of 2824	2196	13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe	31
PID 2196 wrote to memory of 2824	2196	13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe	31
PID 2196 wrote to memory of 2620	2196	13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe	33
PID 2196 wrote to memory of 2620	2196	13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe	33
PID 2196 wrote to memory of 2620	2196	13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe	33
PID 2196 wrote to memory of 1096	2196	13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe	35
PID 2196 wrote to memory of 1096	2196	13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe	35
PID 2196 wrote to memory of 1096	2196	13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe	35
PID 2196 wrote to memory of 2228	2196	13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe	37
PID 2196 wrote to memory of 2228	2196	13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe	37
PID 2196 wrote to memory of 2228	2196	13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe	37
PID 2196 wrote to memory of 2264	2196	13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe	39
PID 2196 wrote to memory of 2264	2196	13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe	39
PID 2196 wrote to memory of 2264	2196	13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe	39

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe
"C:\Users\Admin\AppData\Local\Temp\13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '13cbc690202bd7f229b813662711205361e63409057d5756859d560026698d11N.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Microsoft Edge.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Microsoft Edge.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2228
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Microsoft Edge" /tr "C:\Users\Admin\Microsoft Edge.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2264

C:\Windows\system32\taskeng.exe
taskeng.exe {63C19F00-D2CC-40C1-ADCE-3E30A3841A48} S-1-5-21-1846800975-3917212583-2893086201-1000:ZQABOPWE\Admin:Interactive:[1]
1⤵
PID:1504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
3fb566ce95f6092e635434f9a2560b54

SHA1
88b965493850e5f60ab62ec0fa43a9263f736b02

SHA256
22784dad22d299aafa59e0b2cb51497a6b6bb298d9d7ed6132ec9cf9dc830c05

SHA512
6a753a0bcc707d3d1d11ede33015ee736a6abfaa2c2317dec4b52cda27eee540e82ebb71fb6421fb79b3b07d025fe26d2560ccac52071cf9ad21e8accb7207f9

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2196-0-0x000007FEF6123000-0x000007FEF6124000-memory.dmp

Filesize
4KB

Download
memory/2196-1-0x00000000008A0000-0x00000000008B6000-memory.dmp

Filesize
88KB

Download
memory/2196-2-0x000007FEF6120000-0x000007FEF6B0C000-memory.dmp

Filesize
9.9MB

Download
memory/2196-28-0x000007FEF6123000-0x000007FEF6124000-memory.dmp

Filesize
4KB

Download
memory/2196-33-0x000007FEF6120000-0x000007FEF6B0C000-memory.dmp

Filesize
9.9MB

Download
memory/2620-15-0x000000001B710000-0x000000001B9F2000-memory.dmp

Filesize
2.9MB

Download
memory/2620-16-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/2824-7-0x0000000001CF0000-0x0000000001D70000-memory.dmp

Filesize
512KB

Download
memory/2824-8-0x000000001B6B0000-0x000000001B992000-memory.dmp

Filesize
2.9MB

Download
memory/2824-9-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads