xworm | 88d0612d150853b8e7f3d3e3bfbc5d96d0469df4b53b6e2afbb882e39324b3c6

Reason

Machine shutdown

General

Target

Nezur_Internal.exe
Size

1.3MB
MD5

c8e3253dfa6d5a21b87950dd7eb2c652
SHA1

c0d8849408efd3b42e07b8f43ecb2979158c9c0f
SHA256

b8d5ab8adf0da37f5fcd09e09d3bab66458f4cd6fefc5760daa8c247fd55eb76
SHA512

efa4cc3ccaa797c9f9c64c4aa6f4f0aa995d3e36bfe0563b7ffce0978ff880bc4fa913c363fbf7792fe552753098e870642b35602cf8625938e9ff84a1d376d9
SSDEEP

24576:cUTaQIolipFeyKvY4JMdA9MpBO++aBIbH1CAB1v:caIowzeth9KIbHhBp

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

C2

drive-mens.gl.at.ply.gg:20498

Attributes

Install_directory
%AppData%
install_file
SystemUser.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023c64-6.dat	family_xworm
behavioral2/memory/3104-18-0x0000000000D40000-0x0000000000D50000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Nezur_Internal.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemUser.lnk	wyvernunbanner.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemUser.lnk	wyvernunbanner.exe

Executes dropped EXE 2 IoCs

pid	Process
3104	wyvernunbanner.exe
4900	Nezur_Loader.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
7	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "46"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4900	Nezur_Loader.exe
4900	Nezur_Loader.exe
4900	Nezur_Loader.exe
4900	Nezur_Loader.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3104	wyvernunbanner.exe
Token: SeDebugPrivilege	4900	Nezur_Loader.exe
Token: SeShutdownPrivilege	2748	shutdown.exe
Token: SeRemoteShutdownPrivilege	2748	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2264	LogonUI.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 3104	2988	Nezur_Internal.exe	82
PID 2988 wrote to memory of 3104	2988	Nezur_Internal.exe	82
PID 2988 wrote to memory of 4900	2988	Nezur_Internal.exe	83
PID 2988 wrote to memory of 4900	2988	Nezur_Internal.exe	83
PID 3104 wrote to memory of 2748	3104	wyvernunbanner.exe	97
PID 3104 wrote to memory of 2748	3104	wyvernunbanner.exe	97

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	7	curl/8.6.0-DEV

C:\Users\Admin\AppData\Local\Temp\Nezur_Internal.exe
"C:\Users\Admin\AppData\Local\Temp\Nezur_Internal.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Users\Admin\AppData\Roaming\wyvernunbanner.exe
  "C:\Users\Admin\AppData\Roaming\wyvernunbanner.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Windows\SYSTEM32\shutdown.exe
    shutdown.exe /f /s /t 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2748
- C:\Users\Admin\AppData\Roaming\Nezur_Loader.exe
  "C:\Users\Admin\AppData\Roaming\Nezur_Loader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4900

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3998055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Nezur_Loader.exe

Filesize
1.2MB

MD5
65e9703b2974342ee9f1689f75de78fc

SHA1
3acb6ca13d01f5b5d3b7016c44cd5cbbe64b5f0a

SHA256
5e12aa23829e37a5ba2250eb4ac4bb859c87bcc337522286b2da85113af7d255

SHA512
b357f60d6dbd19f0f47b608e7c89a5a1c405c9c3915530df71976696fbb7d51c15ac69d01be2ace5668ebc87936e815d8d414472cc0429e29c8cf18edec6cd7d

Download Submit
C:\Users\Admin\AppData\Roaming\wyvernunbanner.exe

Filesize
41KB

MD5
8c0ead2cbe490984b478ec5f694d187c

SHA1
7c2ad7cbeb7722825421cdf457a00259cbd2c177

SHA256
a0150c4e756d7df71931fb9661be086354b36bf654aaa6acc2d51e5ff0da9c25

SHA512
4a0dfd3b984185af61c1502c1894a73738e16ea841c3b877d2ebc5d7bc302b8dbecdbf9b3fc78f2ebdced4e32360c9fde7dfff964ec1701c6627639b8b231d78

Download Submit
memory/2988-0-0x00007FFA5E943000-0x00007FFA5E945000-memory.dmp

Filesize
8KB

Download
memory/2988-1-0x0000000000E90000-0x0000000000FE6000-memory.dmp

Filesize
1.3MB

Download
memory/3104-18-0x0000000000D40000-0x0000000000D50000-memory.dmp

Filesize
64KB

Download
memory/3104-22-0x00007FFA5E940000-0x00007FFA5F401000-memory.dmp

Filesize
10.8MB

Download
memory/3104-28-0x00007FFA5E940000-0x00007FFA5F401000-memory.dmp

Filesize
10.8MB

Download
memory/3104-29-0x00007FFA5E940000-0x00007FFA5F401000-memory.dmp

Filesize
10.8MB

Download
memory/3104-30-0x00007FFA5E940000-0x00007FFA5F401000-memory.dmp

Filesize
10.8MB

Download
memory/3104-32-0x00007FFA5E940000-0x00007FFA5F401000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

Errors