xworm | a12ff85cf94a5221eaa400be0fb0df03b75c2efffd44cfd4c5c6cee355da42d5

General

Target

VixenLoader.exe
Size

38.3MB
MD5

42660a451f750c72df213ed8b234da84
SHA1

57d610944313b20cec5918d8e4a482eebbe45beb
SHA256

6d2cf58460eeebc417121afd3d5b0592b88b16f1b115e16aba32049437d05832
SHA512

3843a449128f6be9ec4cfaee84c6c9c323b79bdfd22c9cf582c7f563c125db66fd12ae9324af197265e0da6faf30cb2a5a9e966c9343d9d098b0a8a38c655526
SSDEEP

786432:73skHahOcCzPA18A/Fk+SfyNqDOjM8VzG4j9rL5nUbVOtsa:zmhQ4iA/eVrCtzGoZ1Ug

Score

10^/10

xworm discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

play-treatments.gl.at.ply.gg:50330

Mutex

0JSF3VLcLKVr7CJP

Attributes

Install_directory
%ProgramData%
install_file
System.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000800000001933b-9.dat	family_xworm
behavioral1/memory/2188-45-0x0000000000E20000-0x0000000000E30000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3000	powershell.exe
2668	powershell.exe
1560	powershell.exe
3024	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk	System.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk	System.exe

Executes dropped EXE 3 IoCs

pid	Process
1884	Registry.exe
2188	System.exe
2844	Stub.exe

Loads dropped DLL 4 IoCs

pid	Process
2388	VixenLoader.exe
2388	VixenLoader.exe
1884	Registry.exe
2844	Stub.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "C:\\ProgramData\\System.exe"	System.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VixenLoader.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2908	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3000	powershell.exe
2668	powershell.exe
1560	powershell.exe
3024	powershell.exe
2188	System.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2188	System.exe
Token: SeDebugPrivilege	3000	powershell.exe
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeDebugPrivilege	1560	powershell.exe
Token: SeDebugPrivilege	3024	powershell.exe
Token: SeDebugPrivilege	2188	System.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2188	System.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 1884	2388	VixenLoader.exe	31
PID 2388 wrote to memory of 1884	2388	VixenLoader.exe	31
PID 2388 wrote to memory of 1884	2388	VixenLoader.exe	31
PID 2388 wrote to memory of 1884	2388	VixenLoader.exe	31
PID 2388 wrote to memory of 2188	2388	VixenLoader.exe	32
PID 2388 wrote to memory of 2188	2388	VixenLoader.exe	32
PID 2388 wrote to memory of 2188	2388	VixenLoader.exe	32
PID 2388 wrote to memory of 2188	2388	VixenLoader.exe	32
PID 1884 wrote to memory of 2844	1884	Registry.exe	33
PID 1884 wrote to memory of 2844	1884	Registry.exe	33
PID 1884 wrote to memory of 2844	1884	Registry.exe	33
PID 2188 wrote to memory of 3000	2188	System.exe	34
PID 2188 wrote to memory of 3000	2188	System.exe	34
PID 2188 wrote to memory of 3000	2188	System.exe	34
PID 2188 wrote to memory of 2668	2188	System.exe	36
PID 2188 wrote to memory of 2668	2188	System.exe	36
PID 2188 wrote to memory of 2668	2188	System.exe	36
PID 2188 wrote to memory of 1560	2188	System.exe	38
PID 2188 wrote to memory of 1560	2188	System.exe	38
PID 2188 wrote to memory of 1560	2188	System.exe	38
PID 2188 wrote to memory of 3024	2188	System.exe	40
PID 2188 wrote to memory of 3024	2188	System.exe	40
PID 2188 wrote to memory of 3024	2188	System.exe	40
PID 2188 wrote to memory of 2908	2188	System.exe	42
PID 2188 wrote to memory of 2908	2188	System.exe	42
PID 2188 wrote to memory of 2908	2188	System.exe	42

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\VixenLoader.exe
"C:\Users\Admin\AppData\Local\Temp\VixenLoader.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Users\Admin\AppData\Local\Temp\Registry.exe
  "C:\Users\Admin\AppData\Local\Temp\Registry.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Users\Admin\AppData\Local\Temp\onefile_1884_133785071099712000\Stub.exe
    C:\Users\Admin\AppData\Local\Temp\Registry.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2844
- C:\Users\Admin\AppData\Local\Temp\System.exe
  "C:\Users\Admin\AppData\Local\Temp\System.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\System.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2668
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\System.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3024
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System" /tr "C:\ProgramData\System.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\onefile_1884_133785071099712000\python310.dll

Filesize
4.3MB

MD5
e4533934b37e688106beac6c5919281e

SHA1
ada39f10ef0bbdcf05822f4260e43d53367b0017

SHA256
2bf761bae584ba67d9a41507b45ebd41ab6ae51755b1782496d0bc60cc1d41d5

SHA512
fa681a48ddd81854c9907026d4f36b008e509729f1d9a18a621f1d86cd1176c1a1ff4f814974306fa4d9e3886e2ce112a4f79b66713e1401f5dae4bcd8b898b9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
c92bf7773771c58cbb1528e16465ab75

SHA1
62b4a899af9c8eed7b883123369b0ab57027fe06

SHA256
33fb0a3892f0432e8774d9c4bb1dd080f78da8f17f99b485ea38c92bc63b47d7

SHA512
1cf45f5f0ab7764d122e1c9b4ba4db91f6200ef50f4f916dd0a4f1660603c0f551981d795e86bfb2ae06355f49ba5c38d54c1c2b3a1819688424ca5ae3815a54

Download Submit
\Users\Admin\AppData\Local\Temp\Registry.exe

Filesize
38.2MB

MD5
b4c97238cbd3eef2220646a06ad12d3d

SHA1
448cd7706447ec684ddbdfa86298ab7ebe2b5d37

SHA256
1b2e36cb8bece957248db97bae8a1ea60c606a968da4ec1b8ef7bd740a3d30ab

SHA512
d823a9c84e93946b139ba771c4ab9b9a46236689f4140712d6c122517660225e9cb927dd0be79d7e4920b5cf567daf124d67ae714a99952f26434a2b887bf8cc

Download Submit
\Users\Admin\AppData\Local\Temp\System.exe

Filesize
39KB

MD5
dda376d12dabb5271a3678e378fe5b11

SHA1
91711a77680345ef75c1ca6b0c5f46fc5afc9044

SHA256
f59efc57c51f6605eed29422e8c97c0d1098d6e920a9a89957625f08785160e1

SHA512
7166ad32241e4b7534cc619943369f8daf3daf8e85ff2f2ce96551ad712930bcca3db534470d435448280b342bb380a84c7d52619ccd4932ccc6b786e4ecc03f

Download Submit
memory/2188-45-0x0000000000E20000-0x0000000000E30000-memory.dmp

Filesize
64KB

Download
memory/2668-57-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/2668-58-0x0000000002070000-0x0000000002078000-memory.dmp

Filesize
32KB

Download
memory/3000-50-0x000000001B420000-0x000000001B702000-memory.dmp

Filesize
2.9MB

Download
memory/3000-51-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads