xworm | 264cfa973e4a1b05c208728074dc9b072c180502494644d324086ba66f791c7c

General

Target

Dettex.exe
Size

90KB
MD5

1c2a253948135b876e3fe148f45040f1
SHA1

c546d4e05316819469003b332b4bd2a9c4e5f5fd
SHA256

264cfa973e4a1b05c208728074dc9b072c180502494644d324086ba66f791c7c
SHA512

b8e2887c5a7562a001ed013aee2f747aae3e916c85810aff2e857272f75be6c06fd8774a4c2d3676a6fe60dce57f4f9f223092f69036dde4378b71ed9fae7b7f
SSDEEP

1536:4xnmcCQLrqkUScY177xIO0bOU5pXZX8b60/S/OPEp9QcmzhRaA5am:MmWn9Uy76ZbHp8/2O49IFRN5am

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:22100

wide-casting.gl.at.ply.gg:22100

Attributes

Install_directory
%AppData%
install_file
Dettex.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2360-1-0x0000000000E00000-0x0000000000E1C000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2688	powershell.exe
2676	powershell.exe
2324	powershell.exe
2620	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dettex.lnk	Dettex.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dettex.lnk	Dettex.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dettex = "C:\\Users\\Admin\\AppData\\Roaming\\Dettex.exe"	Dettex.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2688	powershell.exe
2676	powershell.exe
2324	powershell.exe
2620	powershell.exe
2360	Dettex.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2360	Dettex.exe
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	2676	powershell.exe
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeDebugPrivilege	2360	Dettex.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2360	Dettex.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2688	2360	Dettex.exe	32
PID 2360 wrote to memory of 2688	2360	Dettex.exe	32
PID 2360 wrote to memory of 2688	2360	Dettex.exe	32
PID 2360 wrote to memory of 2676	2360	Dettex.exe	34
PID 2360 wrote to memory of 2676	2360	Dettex.exe	34
PID 2360 wrote to memory of 2676	2360	Dettex.exe	34
PID 2360 wrote to memory of 2324	2360	Dettex.exe	36
PID 2360 wrote to memory of 2324	2360	Dettex.exe	36
PID 2360 wrote to memory of 2324	2360	Dettex.exe	36
PID 2360 wrote to memory of 2620	2360	Dettex.exe	38
PID 2360 wrote to memory of 2620	2360	Dettex.exe	38
PID 2360 wrote to memory of 2620	2360	Dettex.exe	38

C:\Users\Admin\AppData\Local\Temp\Dettex.exe
"C:\Users\Admin\AppData\Local\Temp\Dettex.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Dettex.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Dettex.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Dettex.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Dettex.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
a35b49a3b987b8650b54697dc03c7a7e

SHA1
fec4d77059eb83febdad9a2703b27a53e243e35f

SHA256
74289843313a3c01fdfe940769a3f12f897ce5a9dd9c784e73011e881bd6ff11

SHA512
3628082bcc9bc956e62f98d36ed04f58d6b90b42985015328f70aa7d4902e48c45615ee1bc48750a59e72a109c4faebe80206e61281836dbab94a12e66090054

Download Submit
memory/2360-0-0x000007FEF5A13000-0x000007FEF5A14000-memory.dmp

Filesize
4KB

Download
memory/2360-1-0x0000000000E00000-0x0000000000E1C000-memory.dmp

Filesize
112KB

Download
memory/2360-2-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

Filesize
9.9MB

Download
memory/2360-28-0x000007FEF5A13000-0x000007FEF5A14000-memory.dmp

Filesize
4KB

Download
memory/2360-33-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

Filesize
9.9MB

Download
memory/2676-15-0x000000001B5A0000-0x000000001B882000-memory.dmp

Filesize
2.9MB

Download
memory/2676-16-0x0000000001D90000-0x0000000001D98000-memory.dmp

Filesize
32KB

Download
memory/2688-7-0x0000000002CD0000-0x0000000002D50000-memory.dmp

Filesize
512KB

Download
memory/2688-8-0x000000001B620000-0x000000001B902000-memory.dmp

Filesize
2.9MB

Download
memory/2688-9-0x00000000028E0000-0x00000000028E8000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads