xworm | e41f276291b01717c78ffe3d6a288bf95b42da33445c0c8490e0b546fe380935

General

Target

2025-01-17-13-06-51.exe
Size

77KB
MD5

e2b82b4f39f2527e850756664e5462a1
SHA1

8de7c878e724e1667cc90f3fad7b109f5ed65927
SHA256

e41f276291b01717c78ffe3d6a288bf95b42da33445c0c8490e0b546fe380935
SHA512

5cb25a33e937febb5f8255e2a80eaa1fccc4b5f6442e831d47839ba896727b85e139af5195c46957187b422c7f010f2349320ef977d4598f4b26f8ca2d573a82
SSDEEP

1536:0042Bt3U61POAeecviUOeWHiMbKNQpxjNG68MPMKORGAkTxdw9:IoNU61PO6cvrFWvbKQKrKORkTw9

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

trip-thesaurus.gl.at.ply.gg:16715

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1972-1-0x00000000008B0000-0x00000000008CA000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2856	powershell.exe
2444	powershell.exe
2812	powershell.exe
2764	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.lnk	2025-01-17-13-06-51.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.lnk	2025-01-17-13-06-51.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Users\\Admin\\AppData\\Roaming\\SecurityHealthSystray"	2025-01-17-13-06-51.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2812	powershell.exe
2764	powershell.exe
2856	powershell.exe
2444	powershell.exe
1972	2025-01-17-13-06-51.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1972	2025-01-17-13-06-51.exe
Token: SeDebugPrivilege	2812	powershell.exe
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeDebugPrivilege	2444	powershell.exe
Token: SeDebugPrivilege	1972	2025-01-17-13-06-51.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1972	2025-01-17-13-06-51.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2812	1972	2025-01-17-13-06-51.exe	31
PID 1972 wrote to memory of 2812	1972	2025-01-17-13-06-51.exe	31
PID 1972 wrote to memory of 2812	1972	2025-01-17-13-06-51.exe	31
PID 1972 wrote to memory of 2764	1972	2025-01-17-13-06-51.exe	33
PID 1972 wrote to memory of 2764	1972	2025-01-17-13-06-51.exe	33
PID 1972 wrote to memory of 2764	1972	2025-01-17-13-06-51.exe	33
PID 1972 wrote to memory of 2856	1972	2025-01-17-13-06-51.exe	35
PID 1972 wrote to memory of 2856	1972	2025-01-17-13-06-51.exe	35
PID 1972 wrote to memory of 2856	1972	2025-01-17-13-06-51.exe	35
PID 1972 wrote to memory of 2444	1972	2025-01-17-13-06-51.exe	37
PID 1972 wrote to memory of 2444	1972	2025-01-17-13-06-51.exe	37
PID 1972 wrote to memory of 2444	1972	2025-01-17-13-06-51.exe	37

C:\Users\Admin\AppData\Local\Temp\2025-01-17-13-06-51.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-17-13-06-51.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2025-01-17-13-06-51.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '2025-01-17-13-06-51.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\SecurityHealthSystray'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SecurityHealthSystray'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
4850892c08b19bf6b65f63c93c03870b

SHA1
977943461f3b77040bed999aef456cffbb740646

SHA256
f3f786921d3509d658e636af7e0999236ef3e6235cc268508d991ea14848e9e4

SHA512
b7a0d66ecb30eb79096a0340edecfbbb8d86a83d7d5b9b3ff9236c883183f3977155a654cd1c3ceb2c49f061e9eec0ef5a3edc56c8668b7f7b5b900d304def2c

Download Submit
memory/1972-27-0x000007FEF6643000-0x000007FEF6644000-memory.dmp

Filesize
4KB

Download
memory/1972-2-0x000007FEF6640000-0x000007FEF702C000-memory.dmp

Filesize
9.9MB

Download
memory/1972-1-0x00000000008B0000-0x00000000008CA000-memory.dmp

Filesize
104KB

Download
memory/1972-0-0x000007FEF6643000-0x000007FEF6644000-memory.dmp

Filesize
4KB

Download
memory/1972-31-0x000007FEF6640000-0x000007FEF702C000-memory.dmp

Filesize
9.9MB

Download
memory/1972-32-0x0000000002060000-0x000000000206C000-memory.dmp

Filesize
48KB

Download
memory/1972-34-0x000007FEF6640000-0x000007FEF702C000-memory.dmp

Filesize
9.9MB

Download
memory/2764-15-0x000000001B800000-0x000000001BAE2000-memory.dmp

Filesize
2.9MB

Download
memory/2764-16-0x0000000001F50000-0x0000000001F58000-memory.dmp

Filesize
32KB

Download
memory/2812-7-0x0000000002D00000-0x0000000002D80000-memory.dmp

Filesize
512KB

Download
memory/2812-8-0x000000001B800000-0x000000001BAE2000-memory.dmp

Filesize
2.9MB

Download
memory/2812-9-0x0000000001E10000-0x0000000001E18000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads