xworm | 585afc1a328b48eb4d21af829ecf1d006867c1e634e12fb93a284876c49822fd

General

Target

XClient.exe
Size

194KB
MD5

5acdf267c1c641f10c87797a26384cb3
SHA1

bc338127279d63df363b3576c52655875a994f7c
SHA256

585afc1a328b48eb4d21af829ecf1d006867c1e634e12fb93a284876c49822fd
SHA512

29f9b97cca6ecb08443216105542fabdd607671f1aea8048042fa20d5dfa7f2c895f04ba45d5823863d987b9c0fc630c2713cafafb67351910819edc320f2060
SSDEEP

3072:5aMRfNYn45BIJbUo+f5eO/fqxa3v7EsUT8rmtIhW:5Lf+n4cbFKq0/HUTftO

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Attributes

Install_directory
%AppData%
install_file
svchost.exe
pastebin_url
https://pastebin.com/raw/YzbfPdbq
telegram
https://api.telegram.org/bot7197152041:AAFBciIfecRKNs2FGtIwUCQpjjW4nxCmIQo/sendMessage?chat_id=7306315268

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2364-1-0x00000000010D0000-0x0000000001106000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2316	powershell.exe
2768	powershell.exe
2948	powershell.exe
2744	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	XClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	XClient.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs

Web Service

T1102

flow	ioc
7	pastebin.com
10	0.tcp.eu.ngrok.io
15	0.tcp.eu.ngrok.io
39	0.tcp.eu.ngrok.io
52	0.tcp.eu.ngrok.io
62	0.tcp.eu.ngrok.io
6	pastebin.com
12	0.tcp.eu.ngrok.io
23	0.tcp.eu.ngrok.io
32	0.tcp.eu.ngrok.io
43	0.tcp.eu.ngrok.io
66	0.tcp.eu.ngrok.io
54	0.tcp.eu.ngrok.io
56	0.tcp.eu.ngrok.io
69	0.tcp.eu.ngrok.io

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2316	powershell.exe
2768	powershell.exe
2948	powershell.exe
2744	powershell.exe
2364	XClient.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2364	XClient.exe
Token: SeDebugPrivilege	2316	powershell.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeDebugPrivilege	2364	XClient.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2364	XClient.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2316	2364	XClient.exe	31
PID 2364 wrote to memory of 2316	2364	XClient.exe	31
PID 2364 wrote to memory of 2316	2364	XClient.exe	31
PID 2364 wrote to memory of 2768	2364	XClient.exe	33
PID 2364 wrote to memory of 2768	2364	XClient.exe	33
PID 2364 wrote to memory of 2768	2364	XClient.exe	33
PID 2364 wrote to memory of 2948	2364	XClient.exe	35
PID 2364 wrote to memory of 2948	2364	XClient.exe	35
PID 2364 wrote to memory of 2948	2364	XClient.exe	35
PID 2364 wrote to memory of 2744	2364	XClient.exe	37
PID 2364 wrote to memory of 2744	2364	XClient.exe	37
PID 2364 wrote to memory of 2744	2364	XClient.exe	37

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
03d4c34873eb33715c21f5d1d23de225

SHA1
13ee71da20a93aa5731f604b72a70107e8c1f7ef

SHA256
5b1b631f05758785e9cbc8d6b6047b0ac9d3d4fb787a06ff34e9eb97a69938b2

SHA512
3c97a05100a47ca9270f2123750ce6853de37463a9280a8332a5367e897e277bd6431be1213e455a38669802535117e097e253088cd527c068a67a96e145e52c

Download Submit
memory/2316-7-0x0000000001B80000-0x0000000001C00000-memory.dmp

Filesize
512KB

Download
memory/2316-8-0x000000001B720000-0x000000001BA02000-memory.dmp

Filesize
2.9MB

Download
memory/2316-9-0x00000000029E0000-0x00000000029E8000-memory.dmp

Filesize
32KB

Download
memory/2364-0-0x000007FEF59A3000-0x000007FEF59A4000-memory.dmp

Filesize
4KB

Download
memory/2364-1-0x00000000010D0000-0x0000000001106000-memory.dmp

Filesize
216KB

Download
memory/2364-2-0x000007FEF59A0000-0x000007FEF638C000-memory.dmp

Filesize
9.9MB

Download
memory/2364-28-0x000007FEF59A3000-0x000007FEF59A4000-memory.dmp

Filesize
4KB

Download
memory/2364-32-0x000007FEF59A0000-0x000007FEF638C000-memory.dmp

Filesize
9.9MB

Download
memory/2768-15-0x000000001B530000-0x000000001B812000-memory.dmp

Filesize
2.9MB

Download
memory/2768-16-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads