xworm | a12ff85cf94a5221eaa400be0fb0df03b75c2efffd44cfd4c5c6cee355da42d5

Analysis

max time kernel
139s
max time network
137s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12-12-2024 19:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VixenLoader.exe
Size

38.3MB
MD5

42660a451f750c72df213ed8b234da84
SHA1

57d610944313b20cec5918d8e4a482eebbe45beb
SHA256

6d2cf58460eeebc417121afd3d5b0592b88b16f1b115e16aba32049437d05832
SHA512

3843a449128f6be9ec4cfaee84c6c9c323b79bdfd22c9cf582c7f563c125db66fd12ae9324af197265e0da6faf30cb2a5a9e966c9343d9d098b0a8a38c655526
SSDEEP

786432:73skHahOcCzPA18A/Fk+SfyNqDOjM8VzG4j9rL5nUbVOtsa:zmhQ4iA/eVrCtzGoZ1Ug

Score

10^/10

xworm discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

play-treatments.gl.at.ply.gg:50330

Mutex

0JSF3VLcLKVr7CJP

Attributes

Install_directory
%ProgramData%
install_file
System.exe

aes.plain

Signatures

Detect Xworm Payload 5 IoCs

resource	yara_rule
behavioral1/files/0x0007000000016dc8-10.dat	family_xworm
behavioral1/memory/1748-11-0x0000000001110000-0x0000000001120000-memory.dmp	family_xworm
behavioral1/memory/2208-106-0x0000000000020000-0x0000000000030000-memory.dmp	family_xworm
behavioral1/memory/1280-109-0x0000000000370000-0x0000000000380000-memory.dmp	family_xworm
behavioral1/memory/1576-111-0x0000000000ED0000-0x0000000000EE0000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2848	powershell.exe
2148	powershell.exe
2616	powershell.exe
396	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk	System.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk	System.exe

Executes dropped EXE 6 IoCs

pid	Process
3060	Registry.exe
1748	System.exe
2736	Stub.exe
2208	System.exe
1280	System.exe
1576	System.exe

Loads dropped DLL 4 IoCs

pid	Process
3044	VixenLoader.exe
3044	VixenLoader.exe
3060	Registry.exe
2736	Stub.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "C:\\ProgramData\\System.exe"	System.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VixenLoader.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2012	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2848	powershell.exe
2148	powershell.exe
2616	powershell.exe
396	powershell.exe
1748	System.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	1748	System.exe
Token: SeDebugPrivilege	2848	powershell.exe
Token: SeDebugPrivilege	2148	powershell.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	396	powershell.exe
Token: SeDebugPrivilege	1748	System.exe
Token: SeDebugPrivilege	2208	System.exe
Token: SeDebugPrivilege	1280	System.exe
Token: SeDebugPrivilege	1576	System.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1748	System.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 3060	3044	VixenLoader.exe	30
PID 3044 wrote to memory of 3060	3044	VixenLoader.exe	30
PID 3044 wrote to memory of 3060	3044	VixenLoader.exe	30
PID 3044 wrote to memory of 3060	3044	VixenLoader.exe	30
PID 3044 wrote to memory of 1748	3044	VixenLoader.exe	31
PID 3044 wrote to memory of 1748	3044	VixenLoader.exe	31
PID 3044 wrote to memory of 1748	3044	VixenLoader.exe	31
PID 3044 wrote to memory of 1748	3044	VixenLoader.exe	31
PID 3060 wrote to memory of 2736	3060	Registry.exe	32
PID 3060 wrote to memory of 2736	3060	Registry.exe	32
PID 3060 wrote to memory of 2736	3060	Registry.exe	32
PID 1748 wrote to memory of 2848	1748	System.exe	33
PID 1748 wrote to memory of 2848	1748	System.exe	33
PID 1748 wrote to memory of 2848	1748	System.exe	33
PID 1748 wrote to memory of 2148	1748	System.exe	35
PID 1748 wrote to memory of 2148	1748	System.exe	35
PID 1748 wrote to memory of 2148	1748	System.exe	35
PID 1748 wrote to memory of 2616	1748	System.exe	37
PID 1748 wrote to memory of 2616	1748	System.exe	37
PID 1748 wrote to memory of 2616	1748	System.exe	37
PID 1748 wrote to memory of 396	1748	System.exe	39
PID 1748 wrote to memory of 396	1748	System.exe	39
PID 1748 wrote to memory of 396	1748	System.exe	39
PID 1748 wrote to memory of 2012	1748	System.exe	41
PID 1748 wrote to memory of 2012	1748	System.exe	41
PID 1748 wrote to memory of 2012	1748	System.exe	41
PID 1732 wrote to memory of 2208	1732	taskeng.exe	45
PID 1732 wrote to memory of 2208	1732	taskeng.exe	45
PID 1732 wrote to memory of 2208	1732	taskeng.exe	45
PID 1732 wrote to memory of 1280	1732	taskeng.exe	46
PID 1732 wrote to memory of 1280	1732	taskeng.exe	46
PID 1732 wrote to memory of 1280	1732	taskeng.exe	46
PID 1732 wrote to memory of 1576	1732	taskeng.exe	47
PID 1732 wrote to memory of 1576	1732	taskeng.exe	47
PID 1732 wrote to memory of 1576	1732	taskeng.exe	47

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\VixenLoader.exe
"C:\Users\Admin\AppData\Local\Temp\VixenLoader.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Users\Admin\AppData\Local\Temp\Registry.exe
  "C:\Users\Admin\AppData\Local\Temp\Registry.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Users\Admin\AppData\Local\Temp\onefile_3060_133785071850814000\Stub.exe
    C:\Users\Admin\AppData\Local\Temp\Registry.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2736
- C:\Users\Admin\AppData\Local\Temp\System.exe
  "C:\Users\Admin\AppData\Local\Temp\System.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\System.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2848
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2148
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\System.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2616
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:396
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System" /tr "C:\ProgramData\System.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2012

C:\Windows\system32\taskeng.exe
taskeng.exe {6928D1BF-7CC8-42AD-A510-8522181E5291} S-1-5-21-2039016743-699959520-214465309-1000:PIDEURYY\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\ProgramData\System.exe
  C:\ProgramData\System.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2208
- C:\ProgramData\System.exe
  C:\ProgramData\System.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1280
- C:\ProgramData\System.exe
  C:\ProgramData\System.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\System.exe

Filesize
39KB

MD5
dda376d12dabb5271a3678e378fe5b11

SHA1
91711a77680345ef75c1ca6b0c5f46fc5afc9044

SHA256
f59efc57c51f6605eed29422e8c97c0d1098d6e920a9a89957625f08785160e1

SHA512
7166ad32241e4b7534cc619943369f8daf3daf8e85ff2f2ce96551ad712930bcca3db534470d435448280b342bb380a84c7d52619ccd4932ccc6b786e4ecc03f

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_3060_133785071850814000\python310.dll

Filesize
4.3MB

MD5
e4533934b37e688106beac6c5919281e

SHA1
ada39f10ef0bbdcf05822f4260e43d53367b0017

SHA256
2bf761bae584ba67d9a41507b45ebd41ab6ae51755b1782496d0bc60cc1d41d5

SHA512
fa681a48ddd81854c9907026d4f36b008e509729f1d9a18a621f1d86cd1176c1a1ff4f814974306fa4d9e3886e2ce112a4f79b66713e1401f5dae4bcd8b898b9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
28d88aad8c1df1052e8add378b4528d5

SHA1
2f0f478cf5179167b62c29c98fe10f30e7b90ece

SHA256
049efc4f79f4f054913c240645c004fb08cad597bed151b1e99e26124adc01cc

SHA512
165ea4c7311224c5959d0902923c2c46984dfdd44422838269c483a550ed319579ac3fa3d0c443b6ffe669bd664a102d7a7cb2b3e88c4a740e8240def32bd4b4

Download Submit
\Users\Admin\AppData\Local\Temp\Registry.exe

Filesize
38.2MB

MD5
b4c97238cbd3eef2220646a06ad12d3d

SHA1
448cd7706447ec684ddbdfa86298ab7ebe2b5d37

SHA256
1b2e36cb8bece957248db97bae8a1ea60c606a968da4ec1b8ef7bd740a3d30ab

SHA512
d823a9c84e93946b139ba771c4ab9b9a46236689f4140712d6c122517660225e9cb927dd0be79d7e4920b5cf567daf124d67ae714a99952f26434a2b887bf8cc

Download Submit
memory/1280-109-0x0000000000370000-0x0000000000380000-memory.dmp

Filesize
64KB

Download
memory/1576-111-0x0000000000ED0000-0x0000000000EE0000-memory.dmp

Filesize
64KB

Download
memory/1748-11-0x0000000001110000-0x0000000001120000-memory.dmp

Filesize
64KB

Download
memory/2148-85-0x000000001B5B0000-0x000000001B892000-memory.dmp

Filesize
2.9MB

Download
memory/2148-86-0x00000000028E0000-0x00000000028E8000-memory.dmp

Filesize
32KB

Download
memory/2208-106-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/2848-78-0x000000001B700000-0x000000001B9E2000-memory.dmp

Filesize
2.9MB

Download
memory/2848-79-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download