xworm | dcd88d0f563c6164e4e55e706cb5516f957a38d08a9f91b9c1bc61586a2bd591

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-01-2025 10:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XClient..2.exe
Size

38KB
MD5

c9196dc6453467a8680afa368cb2c340
SHA1

8dc19dfa55c638fb737b06bf3edaa04a6406e31f
SHA256

dcd88d0f563c6164e4e55e706cb5516f957a38d08a9f91b9c1bc61586a2bd591
SHA512

30b95c1f218cf918c64694a7c7bc10ee67d04ff7ced7f96592dd7e21231f35cabc976741bc1b7c639cffffb5dd7cd89f4b253487bb078e8d0c7826e04208d412
SSDEEP

768:I4/CHDkUjn5fCja4sYxE7FWPA9pNGOMh0a4c:I4y4Ur5fzFJ9p4OMqZc

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

kit-austria.gl.at.ply.gg:59418

Mutex

KM83UkaVLVqybrWi

Attributes

Install_directory
%AppData%
install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2636-1-0x0000000000C20000-0x0000000000C30000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows SmartScreen.lnk	XClient..2.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows SmartScreen.lnk	XClient..2.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows SmartScreen = "C:\\Users\\Admin\\AppData\\Roaming\\Windows SmartScreen"	XClient..2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2636	XClient..2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2636	XClient..2.exe
Token: SeDebugPrivilege	2636	XClient..2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2636	XClient..2.exe

C:\Users\Admin\AppData\Local\Temp\XClient..2.exe
"C:\Users\Admin\AppData\Local\Temp\XClient..2.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2636-0-0x000007FEF54C3000-0x000007FEF54C4000-memory.dmp

Filesize
4KB

Download
memory/2636-1-0x0000000000C20000-0x0000000000C30000-memory.dmp

Filesize
64KB

Download
memory/2636-5-0x000007FEF54C0000-0x000007FEF5EAC000-memory.dmp

Filesize
9.9MB

Download
memory/2636-6-0x000007FEF54C3000-0x000007FEF54C4000-memory.dmp

Filesize
4KB

Download
memory/2636-7-0x000007FEF54C0000-0x000007FEF5EAC000-memory.dmp

Filesize
9.9MB

Download