xworm | 3cca5bd72a29bcd3621db5307142564ab6d2ecfc909d896d39f356ef3e2d37c0 | Triage

Resubmissions

13/01/2025, 01:12 UTC

250113-bkxc8sykcv 10

11/01/2025, 02:59 UTC

250111-dgsxratjfl 10

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2025, 02:59 UTC

Sharing

Report Analysis Logs

General

Target

Xworm-5.6/._cache_svchost.exe
Size

40KB
MD5

5390ed74a0c3c880fdd6d0e2d135bfe1
SHA1

0dbe542e0fe98e17e877f2e5d1dd6dc252943f41
SHA256

48ca5393cc5f72125e9677a9833e86b4bd65aa4a9c167c6171a2d38359b100d9
SHA512

54699e0c3dba1d2df00aca934264fbf728bc2185024d577f3ce2325a9a04467e5b52d15e5f3a5689fe839afa48175765d55f941879076de8012f4bb84fab9cd7
SSDEEP

768:MWwYyt6YWwAIxBWPA6Z9tF5Pa9GFOwhE332hiF0:+Y4R3AImPA+vFY9GFOwWme0

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

45.141.26.134:7000

Mutex

CcojtGUool4u0Nw2

Attributes

Install_directory
%Userprofile%
install_file
svchost.exe

aes.plain

1
5uEHeSUlaSttOtOOltu3/A==

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/memory/1408-1-0x0000000000490000-0x00000000004A0000-memory.dmp	family_xworm
behavioral2/files/0x000500000001e767-5.dat	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	._cache_svchost.exe

Executes dropped EXE 3 IoCs

pid	Process
3444	svchost.exe
2808	svchost.exe
4596	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\svchost.exe"	._cache_svchost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2532	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1408	._cache_svchost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1408	._cache_svchost.exe
Token: SeDebugPrivilege	1408	._cache_svchost.exe
Token: SeDebugPrivilege	3444	svchost.exe
Token: SeDebugPrivilege	2808	svchost.exe
Token: SeDebugPrivilege	4596	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1408	._cache_svchost.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 2532	1408	._cache_svchost.exe	88
PID 1408 wrote to memory of 2532	1408	._cache_svchost.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Xworm-5.6\._cache_svchost.exe
"C:\Users\Admin\AppData\Local\Temp\Xworm-5.6\._cache_svchost.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\svchost.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2532

C:\Users\Admin\svchost.exe
C:\Users\Admin\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3444

C:\Users\Admin\svchost.exe
C:\Users\Admin\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2808

C:\Users\Admin\svchost.exe
C:\Users\Admin\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4596

Network

DNS

58.55.71.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

58.55.71.13.in-addr.arpa

IN PTR

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

68.32.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

68.32.126.40.in-addr.arpa

IN PTR

Response
DNS

209.205.72.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

209.205.72.20.in-addr.arpa

IN PTR

Response
DNS

ip-api.com

._cache_svchost.exe

Remote address:

8.8.8.8:53

Request

ip-api.com

IN A

Response

ip-api.com

IN A

208.95.112.1
GET

http://ip-api.com/line/?fields=hosting

._cache_svchost.exe

Remote address:

208.95.112.1:80

Request

GET /line/?fields=hosting HTTP/1.1
Host: ip-api.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Sat, 11 Jan 2025 02:59:41 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 6
Access-Control-Allow-Origin: *
X-Ttl: 59
X-Rl: 43
DNS

1.112.95.208.in-addr.arpa

Remote address:

8.8.8.8:53

Request

1.112.95.208.in-addr.arpa

IN PTR

Response

1.112.95.208.in-addr.arpa

IN PTR

ip-apicom
DNS

134.26.141.45.in-addr.arpa

Remote address:

8.8.8.8:53

Request

134.26.141.45.in-addr.arpa

IN PTR

Response

134.26.141.45.in-addr.arpa

IN PTR

45-141-26-134staticcloudforestcoth
DNS

97.17.167.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

97.17.167.52.in-addr.arpa

IN PTR

Response
DNS

50.23.12.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

50.23.12.20.in-addr.arpa

IN PTR

Response
DNS

172.210.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.210.232.199.in-addr.arpa

IN PTR

Response

208.95.112.1:80

http://ip-api.com/line/?fields=hosting

http

._cache_svchost.exe

264 B
307 B
4
3

HTTP Request

GET http://ip-api.com/line/?fields=hosting

HTTP Response

200
45.141.26.134:7000

._cache_svchost.exe

2.4kB
1.4kB
31
28

8.8.8.8:53

58.55.71.13.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

58.55.71.13.in-addr.arpa
8.8.8.8:53

68.32.126.40.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

68.32.126.40.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

209.205.72.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

209.205.72.20.in-addr.arpa
8.8.8.8:53

ip-api.com

dns

._cache_svchost.exe

56 B
72 B
1
1

DNS Request

ip-api.com

DNS Response

208.95.112.1
8.8.8.8:53

1.112.95.208.in-addr.arpa

dns

71 B
95 B
1
1

DNS Request

1.112.95.208.in-addr.arpa
8.8.8.8:53

134.26.141.45.in-addr.arpa

dns

72 B
124 B
1
1

DNS Request

134.26.141.45.in-addr.arpa
8.8.8.8:53

97.17.167.52.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

97.17.167.52.in-addr.arpa
8.8.8.8:53

50.23.12.20.in-addr.arpa

dns

70 B
156 B
1
1

DNS Request

50.23.12.20.in-addr.arpa
8.8.8.8:53

172.210.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.210.232.199.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\svchost.exe

Filesize
40KB

MD5
5390ed74a0c3c880fdd6d0e2d135bfe1

SHA1
0dbe542e0fe98e17e877f2e5d1dd6dc252943f41

SHA256
48ca5393cc5f72125e9677a9833e86b4bd65aa4a9c167c6171a2d38359b100d9

SHA512
54699e0c3dba1d2df00aca934264fbf728bc2185024d577f3ce2325a9a04467e5b52d15e5f3a5689fe839afa48175765d55f941879076de8012f4bb84fab9cd7

Download Submit
memory/1408-0-0x00007FFAC20B3000-0x00007FFAC20B5000-memory.dmp

Filesize
8KB

Download
memory/1408-1-0x0000000000490000-0x00000000004A0000-memory.dmp

Filesize
64KB

Download
memory/1408-2-0x00007FFAC20B0000-0x00007FFAC2B71000-memory.dmp

Filesize
10.8MB

Download
memory/1408-4-0x00007FFAC20B0000-0x00007FFAC2B71000-memory.dmp

Filesize
10.8MB

Download
memory/3444-7-0x00007FFAC20B0000-0x00007FFAC2B71000-memory.dmp

Filesize
10.8MB

Download
memory/3444-9-0x00007FFAC20B0000-0x00007FFAC2B71000-memory.dmp

Filesize
10.8MB

Download