xworm | b46624ea261bec807dc1f93431ab3156450646976443c27322a7a9c4eec5e5f0

Resubmissions

13/01/2025, 01:00

250113-bcnq5axqbt 10

09/01/2025, 12:16

06/01/2025, 14:21

02/01/2025, 20:47

02/01/2025, 20:45

Analysis

max time kernel
224s
max time network
225s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
02/01/2025, 20:47

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Firefox Installer (ratted).exe
Size

170KB
MD5

200eb10c73336127006740ae06003933
SHA1

32ef06528018d4f9fc8da3a7e7e07363b3a143f4
SHA256

b46624ea261bec807dc1f93431ab3156450646976443c27322a7a9c4eec5e5f0
SHA512

026eb0e018f25449f664dbc2655cfb5c360fd60a928fec344bd31b3cefa01a3fcce4dd1fc87b3aabce7557db57cb1247a1984c69b3ecb00d83f388fd6b09a0ce
SSDEEP

1536:4ig4nFL9z2BOwVCMs6se7llqn17KineXd2wVKtivEYoNRh8RX9EIKhI49No:5zFL9zWOw7sgbcUieNJqKoPC5+Lm

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

109.231.31.129:2021

Mutex

H7HNKbba3h7eEPOa

Attributes

Install_directory
%AppData%
install_file
FlrefoxUpdate.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/memory/4952-1-0x0000000000560000-0x0000000000590000-memory.dmp	family_xworm
behavioral1/files/0x001c00000002ab4c-6.dat	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Executes dropped EXE 3 IoCs

pid	Process
2380	FlrefoxUpdate.exe
3596	FlrefoxUpdate.exe
4412	FlrefoxUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "65"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2000	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4952	Firefox Installer (ratted).exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4952	Firefox Installer (ratted).exe
Token: SeDebugPrivilege	4952	Firefox Installer (ratted).exe
Token: SeDebugPrivilege	2380	FlrefoxUpdate.exe
Token: SeDebugPrivilege	3596	FlrefoxUpdate.exe
Token: SeDebugPrivilege	4412	FlrefoxUpdate.exe
Token: SeShutdownPrivilege	3712	shutdown.exe
Token: SeRemoteShutdownPrivilege	3712	shutdown.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4952	Firefox Installer (ratted).exe
1280	LogonUI.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 2000	4952	Firefox Installer (ratted).exe	77
PID 4952 wrote to memory of 2000	4952	Firefox Installer (ratted).exe	77
PID 4952 wrote to memory of 3712	4952	Firefox Installer (ratted).exe	83
PID 4952 wrote to memory of 3712	4952	Firefox Installer (ratted).exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Firefox Installer (ratted).exe
"C:\Users\Admin\AppData\Local\Temp\Firefox Installer (ratted).exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "FlrefoxUpdate" /tr "C:\Users\Admin\AppData\Roaming\FlrefoxUpdate.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2000
- C:\Windows\SYSTEM32\shutdown.exe
  shutdown.exe /f /s /t 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3712

C:\Users\Admin\AppData\Roaming\FlrefoxUpdate.exe
C:\Users\Admin\AppData\Roaming\FlrefoxUpdate.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2380

C:\Users\Admin\AppData\Roaming\FlrefoxUpdate.exe
C:\Users\Admin\AppData\Roaming\FlrefoxUpdate.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3596

C:\Users\Admin\AppData\Roaming\FlrefoxUpdate.exe
C:\Users\Admin\AppData\Roaming\FlrefoxUpdate.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4412

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a03855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\FlrefoxUpdate.exe.log

Filesize
654B

MD5
2cbbb74b7da1f720b48ed31085cbd5b8

SHA1
79caa9a3ea8abe1b9c4326c3633da64a5f724964

SHA256
e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

SHA512
ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

Download Submit
C:\Users\Admin\AppData\Roaming\FlrefoxUpdate.exe

Filesize
170KB

MD5
200eb10c73336127006740ae06003933

SHA1
32ef06528018d4f9fc8da3a7e7e07363b3a143f4

SHA256
b46624ea261bec807dc1f93431ab3156450646976443c27322a7a9c4eec5e5f0

SHA512
026eb0e018f25449f664dbc2655cfb5c360fd60a928fec344bd31b3cefa01a3fcce4dd1fc87b3aabce7557db57cb1247a1984c69b3ecb00d83f388fd6b09a0ce

Download Submit
memory/2380-8-0x00007FFF24490000-0x00007FFF24F52000-memory.dmp

Filesize
10.8MB

Download
memory/2380-10-0x00007FFF24490000-0x00007FFF24F52000-memory.dmp

Filesize
10.8MB

Download
memory/4952-0-0x00007FFF24493000-0x00007FFF24495000-memory.dmp

Filesize
8KB

Download
memory/4952-1-0x0000000000560000-0x0000000000590000-memory.dmp

Filesize
192KB

Download
memory/4952-3-0x00007FFF24490000-0x00007FFF24F52000-memory.dmp

Filesize
10.8MB

Download
memory/4952-4-0x00007FFF24493000-0x00007FFF24495000-memory.dmp

Filesize
8KB

Download
memory/4952-5-0x00007FFF24490000-0x00007FFF24F52000-memory.dmp

Filesize
10.8MB

Download
memory/4952-14-0x000000001B2A0000-0x000000001B2AC000-memory.dmp

Filesize
48KB

Download
memory/4952-15-0x00007FFF24490000-0x00007FFF24F52000-memory.dmp

Filesize
10.8MB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads