xworm | 6d2cf58460eeebc417121afd3d5b0592b88b16f1b115e16aba32049437d05832

Analysis

max time kernel
136s
max time network
133s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-12-2024 16:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VixenLoader.exe
Size

38.3MB
MD5

42660a451f750c72df213ed8b234da84
SHA1

57d610944313b20cec5918d8e4a482eebbe45beb
SHA256

6d2cf58460eeebc417121afd3d5b0592b88b16f1b115e16aba32049437d05832
SHA512

3843a449128f6be9ec4cfaee84c6c9c323b79bdfd22c9cf582c7f563c125db66fd12ae9324af197265e0da6faf30cb2a5a9e966c9343d9d098b0a8a38c655526
SSDEEP

786432:73skHahOcCzPA18A/Fk+SfyNqDOjM8VzG4j9rL5nUbVOtsa:zmhQ4iA/eVrCtzGoZ1Ug

Score

10^/10

xworm discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

play-treatments.gl.at.ply.gg:50330

Mutex

0JSF3VLcLKVr7CJP

Attributes

Install_directory
%ProgramData%
install_file
System.exe

aes.plain

Signatures

Detect Xworm Payload 5 IoCs

resource	yara_rule
behavioral1/files/0x000600000001937b-10.dat	family_xworm
behavioral1/memory/2192-11-0x00000000002D0000-0x00000000002E0000-memory.dmp	family_xworm
behavioral1/memory/2708-105-0x0000000000020000-0x0000000000030000-memory.dmp	family_xworm
behavioral1/memory/1888-108-0x0000000000FD0000-0x0000000000FE0000-memory.dmp	family_xworm
behavioral1/memory/896-110-0x0000000001060000-0x0000000001070000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2928	powershell.exe
1880	powershell.exe
2136	powershell.exe
400	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk	System.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk	System.exe

Executes dropped EXE 6 IoCs

pid	Process
696	Registry.exe
2192	System.exe
2720	Stub.exe
2708	System.exe
1888	System.exe
896	System.exe

Loads dropped DLL 4 IoCs

pid	Process
2384	VixenLoader.exe
2384	VixenLoader.exe
696	Registry.exe
2720	Stub.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "C:\\ProgramData\\System.exe"	System.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VixenLoader.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1360	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2928	powershell.exe
1880	powershell.exe
2136	powershell.exe
400	powershell.exe
2192	System.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2192	System.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	1880	powershell.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeDebugPrivilege	400	powershell.exe
Token: SeDebugPrivilege	2192	System.exe
Token: SeDebugPrivilege	2708	System.exe
Token: SeDebugPrivilege	1888	System.exe
Token: SeDebugPrivilege	896	System.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2192	System.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 696	2384	VixenLoader.exe	30
PID 2384 wrote to memory of 696	2384	VixenLoader.exe	30
PID 2384 wrote to memory of 696	2384	VixenLoader.exe	30
PID 2384 wrote to memory of 696	2384	VixenLoader.exe	30
PID 2384 wrote to memory of 2192	2384	VixenLoader.exe	31
PID 2384 wrote to memory of 2192	2384	VixenLoader.exe	31
PID 2384 wrote to memory of 2192	2384	VixenLoader.exe	31
PID 2384 wrote to memory of 2192	2384	VixenLoader.exe	31
PID 696 wrote to memory of 2720	696	Registry.exe	32
PID 696 wrote to memory of 2720	696	Registry.exe	32
PID 696 wrote to memory of 2720	696	Registry.exe	32
PID 2192 wrote to memory of 2928	2192	System.exe	34
PID 2192 wrote to memory of 2928	2192	System.exe	34
PID 2192 wrote to memory of 2928	2192	System.exe	34
PID 2192 wrote to memory of 1880	2192	System.exe	36
PID 2192 wrote to memory of 1880	2192	System.exe	36
PID 2192 wrote to memory of 1880	2192	System.exe	36
PID 2192 wrote to memory of 2136	2192	System.exe	38
PID 2192 wrote to memory of 2136	2192	System.exe	38
PID 2192 wrote to memory of 2136	2192	System.exe	38
PID 2192 wrote to memory of 400	2192	System.exe	40
PID 2192 wrote to memory of 400	2192	System.exe	40
PID 2192 wrote to memory of 400	2192	System.exe	40
PID 2192 wrote to memory of 1360	2192	System.exe	42
PID 2192 wrote to memory of 1360	2192	System.exe	42
PID 2192 wrote to memory of 1360	2192	System.exe	42
PID 1700 wrote to memory of 2708	1700	taskeng.exe	45
PID 1700 wrote to memory of 2708	1700	taskeng.exe	45
PID 1700 wrote to memory of 2708	1700	taskeng.exe	45
PID 1700 wrote to memory of 1888	1700	taskeng.exe	46
PID 1700 wrote to memory of 1888	1700	taskeng.exe	46
PID 1700 wrote to memory of 1888	1700	taskeng.exe	46
PID 1700 wrote to memory of 896	1700	taskeng.exe	47
PID 1700 wrote to memory of 896	1700	taskeng.exe	47
PID 1700 wrote to memory of 896	1700	taskeng.exe	47

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\VixenLoader.exe
"C:\Users\Admin\AppData\Local\Temp\VixenLoader.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Users\Admin\AppData\Local\Temp\Registry.exe
  "C:\Users\Admin\AppData\Local\Temp\Registry.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:696
- - C:\Users\Admin\AppData\Local\Temp\onefile_696_133786678069996000\Stub.exe
    C:\Users\Admin\AppData\Local\Temp\Registry.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2720
- C:\Users\Admin\AppData\Local\Temp\System.exe
  "C:\Users\Admin\AppData\Local\Temp\System.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\System.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1880
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\System.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:400
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System" /tr "C:\ProgramData\System.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1360

C:\Windows\system32\taskeng.exe
taskeng.exe {E23200CA-C226-49DC-91C9-459C8AE29D01} S-1-5-21-3551809350-4263495960-1443967649-1000:NNYJZAHP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\ProgramData\System.exe
  C:\ProgramData\System.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2708
- C:\ProgramData\System.exe
  C:\ProgramData\System.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1888
- C:\ProgramData\System.exe
  C:\ProgramData\System.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\System.exe

Filesize
39KB

MD5
dda376d12dabb5271a3678e378fe5b11

SHA1
91711a77680345ef75c1ca6b0c5f46fc5afc9044

SHA256
f59efc57c51f6605eed29422e8c97c0d1098d6e920a9a89957625f08785160e1

SHA512
7166ad32241e4b7534cc619943369f8daf3daf8e85ff2f2ce96551ad712930bcca3db534470d435448280b342bb380a84c7d52619ccd4932ccc6b786e4ecc03f

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_696_133786678069996000\python310.dll

Filesize
4.3MB

MD5
e4533934b37e688106beac6c5919281e

SHA1
ada39f10ef0bbdcf05822f4260e43d53367b0017

SHA256
2bf761bae584ba67d9a41507b45ebd41ab6ae51755b1782496d0bc60cc1d41d5

SHA512
fa681a48ddd81854c9907026d4f36b008e509729f1d9a18a621f1d86cd1176c1a1ff4f814974306fa4d9e3886e2ce112a4f79b66713e1401f5dae4bcd8b898b9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
73141cae988c0f6fbb5419c2e5cc9a4f

SHA1
fb186b3a3037d17c416a57a5288ef5892eeb88c0

SHA256
7ab32edaed1027871d6476e50fe0896e446e828be832b4d846185e781221c894

SHA512
ff2a4300d891d5b79a06a154f15a91cd6d5786e15715bc9f806ebb86d3875db394d004d34e55a71d04bba9709ffd0c38d829f68a3491d181181f5c956c9673ea

Download Submit
\Users\Admin\AppData\Local\Temp\Registry.exe

Filesize
38.2MB

MD5
b4c97238cbd3eef2220646a06ad12d3d

SHA1
448cd7706447ec684ddbdfa86298ab7ebe2b5d37

SHA256
1b2e36cb8bece957248db97bae8a1ea60c606a968da4ec1b8ef7bd740a3d30ab

SHA512
d823a9c84e93946b139ba771c4ab9b9a46236689f4140712d6c122517660225e9cb927dd0be79d7e4920b5cf567daf124d67ae714a99952f26434a2b887bf8cc

Download Submit
memory/896-110-0x0000000001060000-0x0000000001070000-memory.dmp

Filesize
64KB

Download
memory/1880-85-0x000000001B600000-0x000000001B8E2000-memory.dmp

Filesize
2.9MB

Download
memory/1880-86-0x0000000001DD0000-0x0000000001DD8000-memory.dmp

Filesize
32KB

Download
memory/1888-108-0x0000000000FD0000-0x0000000000FE0000-memory.dmp

Filesize
64KB

Download
memory/2192-11-0x00000000002D0000-0x00000000002E0000-memory.dmp

Filesize
64KB

Download
memory/2708-105-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/2928-78-0x000000001B600000-0x000000001B8E2000-memory.dmp

Filesize
2.9MB

Download
memory/2928-79-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download