xworm | 7802d5ba1a55e070258c29be56b5cfada559cd462bf6ed5d6aa5804b06e46112

Analysis

max time kernel
134s
max time network
144s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-01-2025 11:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEW ORDER TEU (NT250214).exe
Size

581KB
MD5

3c3b62520e40870390b33f528a8f7619
SHA1

c65f1ca358fcfbce3c1466bc47f3ed89c5d6d42a
SHA256

a2f9f0e73da837b578ef0b58a3bec4795920201b81d82cdb873e3a5198bddb96
SHA512

885aa492e0758099db0b631a3aa214a1cd81f42ffcd900b45293ea9a02fffd412b3fc2eb6579423a911335295d1726102b2381e4ce274e429f9193156de255a8
SSDEEP

12288:n5t6WhRSUunDYbDI13hVE+z5fOsQneDOYoPo4RNEnOef58U/isUkR:P6NnDMDIN5IwfnB7isT

Score

10^/10

xworm discovery execution rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

dorismark81.duckdns.org:28503

Mutex

j2oLPi6pecBOp0er

Attributes

Install_directory
%AppData%
install_file
XClient.exe

aes.plain

Signatures

Detect Xworm Payload 5 IoCs

resource	yara_rule
behavioral1/memory/2740-31-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm
behavioral1/memory/2740-29-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm
behavioral1/memory/2740-28-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm
behavioral1/memory/2740-25-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm
behavioral1/memory/2740-23-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1012	powershell.exe
2028	powershell.exe
1660	powershell.exe
2692	powershell.exe
2972	powershell.exe
1572	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	NEW ORDER TEU (NT250214).exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	NEW ORDER TEU (NT250214).exe

Loads dropped DLL 1 IoCs

pid	Process
2740	NEW ORDER TEU (NT250214).exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2108 set thread context of 2740	2108	NEW ORDER TEU (NT250214).exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NEW ORDER TEU (NT250214).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NEW ORDER TEU (NT250214).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2760	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2108	NEW ORDER TEU (NT250214).exe
2108	NEW ORDER TEU (NT250214).exe
2972	powershell.exe
2692	powershell.exe
1572	powershell.exe
1012	powershell.exe
2028	powershell.exe
1660	powershell.exe
2740	NEW ORDER TEU (NT250214).exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2108	NEW ORDER TEU (NT250214).exe
Token: SeDebugPrivilege	2740	NEW ORDER TEU (NT250214).exe
Token: SeDebugPrivilege	2972	powershell.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	1572	powershell.exe
Token: SeDebugPrivilege	1012	powershell.exe
Token: SeDebugPrivilege	2028	powershell.exe
Token: SeDebugPrivilege	1660	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2740	NEW ORDER TEU (NT250214).exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2692	2108	NEW ORDER TEU (NT250214).exe	31
PID 2108 wrote to memory of 2692	2108	NEW ORDER TEU (NT250214).exe	31
PID 2108 wrote to memory of 2692	2108	NEW ORDER TEU (NT250214).exe	31
PID 2108 wrote to memory of 2692	2108	NEW ORDER TEU (NT250214).exe	31
PID 2108 wrote to memory of 2972	2108	NEW ORDER TEU (NT250214).exe	33
PID 2108 wrote to memory of 2972	2108	NEW ORDER TEU (NT250214).exe	33
PID 2108 wrote to memory of 2972	2108	NEW ORDER TEU (NT250214).exe	33
PID 2108 wrote to memory of 2972	2108	NEW ORDER TEU (NT250214).exe	33
PID 2108 wrote to memory of 2760	2108	NEW ORDER TEU (NT250214).exe	34
PID 2108 wrote to memory of 2760	2108	NEW ORDER TEU (NT250214).exe	34
PID 2108 wrote to memory of 2760	2108	NEW ORDER TEU (NT250214).exe	34
PID 2108 wrote to memory of 2760	2108	NEW ORDER TEU (NT250214).exe	34
PID 2108 wrote to memory of 2740	2108	NEW ORDER TEU (NT250214).exe	37
PID 2108 wrote to memory of 2740	2108	NEW ORDER TEU (NT250214).exe	37
PID 2108 wrote to memory of 2740	2108	NEW ORDER TEU (NT250214).exe	37
PID 2108 wrote to memory of 2740	2108	NEW ORDER TEU (NT250214).exe	37
PID 2108 wrote to memory of 2740	2108	NEW ORDER TEU (NT250214).exe	37
PID 2108 wrote to memory of 2740	2108	NEW ORDER TEU (NT250214).exe	37
PID 2108 wrote to memory of 2740	2108	NEW ORDER TEU (NT250214).exe	37
PID 2108 wrote to memory of 2740	2108	NEW ORDER TEU (NT250214).exe	37
PID 2108 wrote to memory of 2740	2108	NEW ORDER TEU (NT250214).exe	37
PID 2740 wrote to memory of 1572	2740	NEW ORDER TEU (NT250214).exe	38
PID 2740 wrote to memory of 1572	2740	NEW ORDER TEU (NT250214).exe	38
PID 2740 wrote to memory of 1572	2740	NEW ORDER TEU (NT250214).exe	38
PID 2740 wrote to memory of 1572	2740	NEW ORDER TEU (NT250214).exe	38
PID 2740 wrote to memory of 1012	2740	NEW ORDER TEU (NT250214).exe	40
PID 2740 wrote to memory of 1012	2740	NEW ORDER TEU (NT250214).exe	40
PID 2740 wrote to memory of 1012	2740	NEW ORDER TEU (NT250214).exe	40
PID 2740 wrote to memory of 1012	2740	NEW ORDER TEU (NT250214).exe	40
PID 2740 wrote to memory of 2028	2740	NEW ORDER TEU (NT250214).exe	42
PID 2740 wrote to memory of 2028	2740	NEW ORDER TEU (NT250214).exe	42
PID 2740 wrote to memory of 2028	2740	NEW ORDER TEU (NT250214).exe	42
PID 2740 wrote to memory of 2028	2740	NEW ORDER TEU (NT250214).exe	42
PID 2740 wrote to memory of 1660	2740	NEW ORDER TEU (NT250214).exe	44
PID 2740 wrote to memory of 1660	2740	NEW ORDER TEU (NT250214).exe	44
PID 2740 wrote to memory of 1660	2740	NEW ORDER TEU (NT250214).exe	44
PID 2740 wrote to memory of 1660	2740	NEW ORDER TEU (NT250214).exe	44

C:\Users\Admin\AppData\Local\Temp\NEW ORDER TEU (NT250214).exe
"C:\Users\Admin\AppData\Local\Temp\NEW ORDER TEU (NT250214).exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\NEW ORDER TEU (NT250214).exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2692
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GVOdDLzPcCam.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2972
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GVOdDLzPcCam" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE273.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2760
- C:\Users\Admin\AppData\Local\Temp\NEW ORDER TEU (NT250214).exe
  "C:\Users\Admin\AppData\Local\Temp\NEW ORDER TEU (NT250214).exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\NEW ORDER TEU (NT250214).exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1572
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'NEW ORDER TEU (NT250214).exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1012
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2028
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpE273.tmp

Filesize
1KB

MD5
356c2ca20b321447923befb33e46a40d

SHA1
061675372b3e0129df41e5df7962d163bd066d87

SHA256
e81cb5ce3fe75868289466decbd697adbaad3a3eb8ebb4bf4100d9cb233a46d0

SHA512
fc3aecb59a16f05eb059c516bdadbdfb14fd6059aeed28a158ab448c379d4c4dd49455222903e774c025dd415f1ffc12f2afe6cbd4fab5aab306fdb84d4fff2c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PADBFN28Z5KH4O2RA8Z1.temp

Filesize
7KB

MD5
5ea34fb70d514984fa3fed71e484254a

SHA1
116b55ad9e7ef84e5961334dc883a323d2dffe28

SHA256
a1d1fbb6f125d7049fadef21f19d73420826e206fc7657c31152c8d24c749ca6

SHA512
4e353391dc0132725a700fe877963e0e98a43d6be34a3c134d8ecf82b4307b036718e05ac0fb371ab883088f758fed9fa66cf9931c61e39ec473b1f442bcfccc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
5c425b632b41937310429a37f2307897

SHA1
ac529c201d0eaccb1e007fd778aa6399c2ad7677

SHA256
6d767449d180b2c386c76d96caeb4f447f1fd85f4eb37112ffad32d779292f72

SHA512
388053a624b38557b0fd997ddfe0a8fa25c06964e93d71a2ad625e48c9445be87c740b3d8de230af322cdab5300ce461b2c6a1bf7a6591dd068d06303cb33c66

Download Submit
\Users\Admin\AppData\Roaming\XClient.exe

Filesize
581KB

MD5
3c3b62520e40870390b33f528a8f7619

SHA1
c65f1ca358fcfbce3c1466bc47f3ed89c5d6d42a

SHA256
a2f9f0e73da837b578ef0b58a3bec4795920201b81d82cdb873e3a5198bddb96

SHA512
885aa492e0758099db0b631a3aa214a1cd81f42ffcd900b45293ea9a02fffd412b3fc2eb6579423a911335295d1726102b2381e4ce274e429f9193156de255a8

Download Submit
memory/2108-32-0x0000000074770000-0x0000000074E5E000-memory.dmp

Filesize
6.9MB

Download
memory/2108-1-0x0000000001210000-0x00000000012A4000-memory.dmp

Filesize
592KB

Download
memory/2108-2-0x0000000074770000-0x0000000074E5E000-memory.dmp

Filesize
6.9MB

Download
memory/2108-3-0x0000000000500000-0x0000000000526000-memory.dmp

Filesize
152KB

Download
memory/2108-4-0x000000007477E000-0x000000007477F000-memory.dmp

Filesize
4KB

Download
memory/2108-5-0x0000000074770000-0x0000000074E5E000-memory.dmp

Filesize
6.9MB

Download
memory/2108-6-0x00000000005A0000-0x00000000005F4000-memory.dmp

Filesize
336KB

Download
memory/2108-0-0x000000007477E000-0x000000007477F000-memory.dmp

Filesize
4KB

Download
memory/2740-29-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2740-25-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2740-23-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2740-21-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2740-19-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2740-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2740-28-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2740-31-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download