xworm | 04fd0e391c1177b2bf2ef415b7f7470809806cabb25dcd80981feb4a309da2d4

General

Target

Dettex.exe
Size

74KB
MD5

30da326c4c36491b7b602498140a134f
SHA1

f3ec1e8c2219b32bcb2427b54081fce8a0d3ab09
SHA256

04fd0e391c1177b2bf2ef415b7f7470809806cabb25dcd80981feb4a309da2d4
SHA512

9ea404472927c61d31e6941fb36964fe5d5d607ec56655feada98b3d21f00ea4ff6f6dd4cfe42ef8e51b6ff5ed72c7f68778a9e2b885f7437305cd6efa581947
SSDEEP

1536:l1LcsmaO35Ab5gMhqsoUB6WOne86ChRaA5am:ncOb5zdOneFCRN5am

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:50023

custom-authentication.gl.at.ply:50023

Attributes

Install_directory
%AppData%
install_file
Dettex.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2868-1-0x0000000000C30000-0x0000000000C48000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2688	powershell.exe
2268	powershell.exe
2664	powershell.exe
2728	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dettex.lnk	Dettex.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dettex.lnk	Dettex.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dettex = "C:\\Users\\Admin\\AppData\\Roaming\\Dettex.exe"	Dettex.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2268	powershell.exe
2664	powershell.exe
2728	powershell.exe
2688	powershell.exe
2868	Dettex.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2868	Dettex.exe
Token: SeDebugPrivilege	2268	powershell.exe
Token: SeDebugPrivilege	2664	powershell.exe
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	2868	Dettex.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2868	Dettex.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2268	2868	Dettex.exe	29
PID 2868 wrote to memory of 2268	2868	Dettex.exe	29
PID 2868 wrote to memory of 2268	2868	Dettex.exe	29
PID 2868 wrote to memory of 2664	2868	Dettex.exe	31
PID 2868 wrote to memory of 2664	2868	Dettex.exe	31
PID 2868 wrote to memory of 2664	2868	Dettex.exe	31
PID 2868 wrote to memory of 2728	2868	Dettex.exe	33
PID 2868 wrote to memory of 2728	2868	Dettex.exe	33
PID 2868 wrote to memory of 2728	2868	Dettex.exe	33
PID 2868 wrote to memory of 2688	2868	Dettex.exe	35
PID 2868 wrote to memory of 2688	2868	Dettex.exe	35
PID 2868 wrote to memory of 2688	2868	Dettex.exe	35

C:\Users\Admin\AppData\Local\Temp\Dettex.exe
"C:\Users\Admin\AppData\Local\Temp\Dettex.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Dettex.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Dettex.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Dettex.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Dettex.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0F7GMRT6X7EDH2G7QPG3.temp

Filesize
7KB

MD5
6c3556cdc9019efb005658c26d51aff0

SHA1
e6efac794479e66cefdad5e0007583a8cd668a24

SHA256
ee3d060d4a5b5448424e7ddcc501bb8be58628ab93c195a2c72c538d8166a272

SHA512
257973412966c3d17277f5f0165e85736b758a2ce0fa633d295a5a8b7bbc412bd585165feae4575d58a5c81374abded18a9486487a097ae83e1e5452e13fa1f0

Download Submit
memory/2268-7-0x0000000002DE0000-0x0000000002E60000-memory.dmp

Filesize
512KB

Download
memory/2268-8-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/2268-9-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/2664-15-0x000000001B450000-0x000000001B732000-memory.dmp

Filesize
2.9MB

Download
memory/2664-16-0x0000000002B70000-0x0000000002B78000-memory.dmp

Filesize
32KB

Download
memory/2868-0-0x000007FEF5CF3000-0x000007FEF5CF4000-memory.dmp

Filesize
4KB

Download
memory/2868-1-0x0000000000C30000-0x0000000000C48000-memory.dmp

Filesize
96KB

Download
memory/2868-2-0x000007FEF5CF0000-0x000007FEF66DC000-memory.dmp

Filesize
9.9MB

Download
memory/2868-32-0x000007FEF5CF0000-0x000007FEF66DC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads