xworm | a12ff85cf94a5221eaa400be0fb0df03b75c2efffd44cfd4c5c6cee355da42d5

Analysis

max time kernel
132s
max time network
156s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
11/12/2024, 20:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VixenLoader.exe
Size

38.3MB
MD5

42660a451f750c72df213ed8b234da84
SHA1

57d610944313b20cec5918d8e4a482eebbe45beb
SHA256

6d2cf58460eeebc417121afd3d5b0592b88b16f1b115e16aba32049437d05832
SHA512

3843a449128f6be9ec4cfaee84c6c9c323b79bdfd22c9cf582c7f563c125db66fd12ae9324af197265e0da6faf30cb2a5a9e966c9343d9d098b0a8a38c655526
SSDEEP

786432:73skHahOcCzPA18A/Fk+SfyNqDOjM8VzG4j9rL5nUbVOtsa:zmhQ4iA/eVrCtzGoZ1Ug

Score

10^/10

xworm discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

play-treatments.gl.at.ply.gg:50330

Mutex

0JSF3VLcLKVr7CJP

Attributes

Install_directory
%ProgramData%
install_file
System.exe

aes.plain

Signatures

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral1/files/0x0007000000019547-10.dat	family_xworm
behavioral1/memory/2992-28-0x0000000000380000-0x0000000000390000-memory.dmp	family_xworm
behavioral1/memory/1828-105-0x0000000001000000-0x0000000001010000-memory.dmp	family_xworm
behavioral1/memory/884-108-0x0000000001380000-0x0000000001390000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2344	powershell.exe
1116	powershell.exe
1796	powershell.exe
592	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk	System.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk	System.exe

Executes dropped EXE 5 IoCs

pid	Process
2792	Registry.exe
2992	System.exe
1620	Stub.exe
1828	System.exe
884	System.exe

Loads dropped DLL 4 IoCs

pid	Process
2448	VixenLoader.exe
2448	VixenLoader.exe
2792	Registry.exe
1620	Stub.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "C:\\ProgramData\\System.exe"	System.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VixenLoader.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2356	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1116	powershell.exe
1796	powershell.exe
592	powershell.exe
2344	powershell.exe
2992	System.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2992	System.exe
Token: SeDebugPrivilege	1116	powershell.exe
Token: SeDebugPrivilege	1796	powershell.exe
Token: SeDebugPrivilege	592	powershell.exe
Token: SeDebugPrivilege	2344	powershell.exe
Token: SeDebugPrivilege	2992	System.exe
Token: SeDebugPrivilege	1828	System.exe
Token: SeDebugPrivilege	884	System.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2992	System.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2792	2448	VixenLoader.exe	30
PID 2448 wrote to memory of 2792	2448	VixenLoader.exe	30
PID 2448 wrote to memory of 2792	2448	VixenLoader.exe	30
PID 2448 wrote to memory of 2792	2448	VixenLoader.exe	30
PID 2448 wrote to memory of 2992	2448	VixenLoader.exe	31
PID 2448 wrote to memory of 2992	2448	VixenLoader.exe	31
PID 2448 wrote to memory of 2992	2448	VixenLoader.exe	31
PID 2448 wrote to memory of 2992	2448	VixenLoader.exe	31
PID 2792 wrote to memory of 1620	2792	Registry.exe	32
PID 2792 wrote to memory of 1620	2792	Registry.exe	32
PID 2792 wrote to memory of 1620	2792	Registry.exe	32
PID 2992 wrote to memory of 1116	2992	System.exe	33
PID 2992 wrote to memory of 1116	2992	System.exe	33
PID 2992 wrote to memory of 1116	2992	System.exe	33
PID 2992 wrote to memory of 1796	2992	System.exe	35
PID 2992 wrote to memory of 1796	2992	System.exe	35
PID 2992 wrote to memory of 1796	2992	System.exe	35
PID 2992 wrote to memory of 592	2992	System.exe	37
PID 2992 wrote to memory of 592	2992	System.exe	37
PID 2992 wrote to memory of 592	2992	System.exe	37
PID 2992 wrote to memory of 2344	2992	System.exe	39
PID 2992 wrote to memory of 2344	2992	System.exe	39
PID 2992 wrote to memory of 2344	2992	System.exe	39
PID 2992 wrote to memory of 2356	2992	System.exe	41
PID 2992 wrote to memory of 2356	2992	System.exe	41
PID 2992 wrote to memory of 2356	2992	System.exe	41
PID 1496 wrote to memory of 1828	1496	taskeng.exe	44
PID 1496 wrote to memory of 1828	1496	taskeng.exe	44
PID 1496 wrote to memory of 1828	1496	taskeng.exe	44
PID 1496 wrote to memory of 884	1496	taskeng.exe	46
PID 1496 wrote to memory of 884	1496	taskeng.exe	46
PID 1496 wrote to memory of 884	1496	taskeng.exe	46

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\VixenLoader.exe
"C:\Users\Admin\AppData\Local\Temp\VixenLoader.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Users\Admin\AppData\Local\Temp\Registry.exe
  "C:\Users\Admin\AppData\Local\Temp\Registry.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Users\Admin\AppData\Local\Temp\onefile_2792_133784634617530000\Stub.exe
    C:\Users\Admin\AppData\Local\Temp\Registry.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1620
- C:\Users\Admin\AppData\Local\Temp\System.exe
  "C:\Users\Admin\AppData\Local\Temp\System.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\System.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\System.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:592
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2344
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System" /tr "C:\ProgramData\System.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2356

C:\Windows\system32\taskeng.exe
taskeng.exe {3273DDCE-7ECD-479B-B620-151E888E05C8} S-1-5-21-3692679935-4019334568-335155002-1000:BCXRJFKE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\ProgramData\System.exe
  C:\ProgramData\System.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1828
- C:\ProgramData\System.exe
  C:\ProgramData\System.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\System.exe

Filesize
39KB

MD5
dda376d12dabb5271a3678e378fe5b11

SHA1
91711a77680345ef75c1ca6b0c5f46fc5afc9044

SHA256
f59efc57c51f6605eed29422e8c97c0d1098d6e920a9a89957625f08785160e1

SHA512
7166ad32241e4b7534cc619943369f8daf3daf8e85ff2f2ce96551ad712930bcca3db534470d435448280b342bb380a84c7d52619ccd4932ccc6b786e4ecc03f

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2792_133784634617530000\python310.dll

Filesize
4.3MB

MD5
e4533934b37e688106beac6c5919281e

SHA1
ada39f10ef0bbdcf05822f4260e43d53367b0017

SHA256
2bf761bae584ba67d9a41507b45ebd41ab6ae51755b1782496d0bc60cc1d41d5

SHA512
fa681a48ddd81854c9907026d4f36b008e509729f1d9a18a621f1d86cd1176c1a1ff4f814974306fa4d9e3886e2ce112a4f79b66713e1401f5dae4bcd8b898b9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
ba7d4cc2882d91db489219fbe82b5b08

SHA1
5b09ccce33ca0bade1bc9fedb3c7d40aed3a7cb6

SHA256
05859b872f5bc0dc6938e946f352d2b517f57b0ee39ab4e14c6f22a17c562502

SHA512
be4b9033f81a96715bd01d59ebde10f90cf5559094369bba0a60a36dd2531ea61e58617d93043d807eeba117bfb295785448f9250324647af86d2dffa54ef250

Download Submit
\Users\Admin\AppData\Local\Temp\Registry.exe

Filesize
38.2MB

MD5
b4c97238cbd3eef2220646a06ad12d3d

SHA1
448cd7706447ec684ddbdfa86298ab7ebe2b5d37

SHA256
1b2e36cb8bece957248db97bae8a1ea60c606a968da4ec1b8ef7bd740a3d30ab

SHA512
d823a9c84e93946b139ba771c4ab9b9a46236689f4140712d6c122517660225e9cb927dd0be79d7e4920b5cf567daf124d67ae714a99952f26434a2b887bf8cc

Download Submit
memory/884-108-0x0000000001380000-0x0000000001390000-memory.dmp

Filesize
64KB

Download
memory/1116-78-0x000000001B180000-0x000000001B462000-memory.dmp

Filesize
2.9MB

Download
memory/1116-79-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

Filesize
32KB

Download
memory/1796-85-0x000000001B2C0000-0x000000001B5A2000-memory.dmp

Filesize
2.9MB

Download
memory/1796-86-0x00000000024E0000-0x00000000024E8000-memory.dmp

Filesize
32KB

Download
memory/1828-105-0x0000000001000000-0x0000000001010000-memory.dmp

Filesize
64KB

Download
memory/2992-28-0x0000000000380000-0x0000000000390000-memory.dmp

Filesize
64KB

Download