xworm | 4414027d7369fa5b62c6cff9836dc792389c085defc5cba782793159e81036b1

General

Target

Spoofer.exe
Size

90KB
MD5

cb8398c640f85445d6e14a2e325eb826
SHA1

2e888003ab1bda0e17297361901be57fbc746e4e
SHA256

4414027d7369fa5b62c6cff9836dc792389c085defc5cba782793159e81036b1
SHA512

268d3bace276b09e15f089e5e19b0181c3060c2965f1d24a2355123bfff8d0f274051c24132040002a0abf727f259756fecebc858050eeaa5445525a7d9d4833
SSDEEP

1536:5jx25uS8KkpHTe9yivqHLrZ+UGpCr8lFo4XwCjAaBhlPrTAdxJ2MT6UaIPxnLxHY:51KuNrpH21CHLt9GMCbHlPXAhEU3xZ6z

Score

10^/10

xworm defense_evasion discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

trip-thesaurus.gl.at.ply.gg:16715

Attributes

Install_directory
%AppData%
install_file
SecurityHealthSystray.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000b000000023b7f-4.dat	family_xworm
behavioral2/memory/1948-12-0x00000000003D0000-0x00000000003EC000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1820	powershell.exe
1676	powershell.exe
4028	powershell.exe
5020	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Spoofer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Woofer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.lnk	Woofer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.lnk	Woofer.exe

Executes dropped EXE 1 IoCs

pid	Process
1948	Woofer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Users\\Admin\\AppData\\Roaming\\SecurityHealthSystray.exe"	Woofer.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spoofer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
516	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1948	Woofer.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
5008	powershell.exe
5008	powershell.exe
4028	powershell.exe
4028	powershell.exe
5020	powershell.exe
5020	powershell.exe
1820	powershell.exe
1820	powershell.exe
1676	powershell.exe
1676	powershell.exe
1948	Woofer.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1948	Woofer.exe
Token: SeDebugPrivilege	5008	powershell.exe
Token: SeDebugPrivilege	4028	powershell.exe
Token: SeDebugPrivilege	5020	powershell.exe
Token: SeDebugPrivilege	1820	powershell.exe
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeDebugPrivilege	1948	Woofer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1948	Woofer.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 5008	3028	Spoofer.exe	83
PID 3028 wrote to memory of 5008	3028	Spoofer.exe	83
PID 3028 wrote to memory of 5008	3028	Spoofer.exe	83
PID 3028 wrote to memory of 1948	3028	Spoofer.exe	85
PID 3028 wrote to memory of 1948	3028	Spoofer.exe	85
PID 1948 wrote to memory of 4028	1948	Woofer.exe	88
PID 1948 wrote to memory of 4028	1948	Woofer.exe	88
PID 1948 wrote to memory of 5020	1948	Woofer.exe	90
PID 1948 wrote to memory of 5020	1948	Woofer.exe	90
PID 1948 wrote to memory of 1820	1948	Woofer.exe	92
PID 1948 wrote to memory of 1820	1948	Woofer.exe	92
PID 1948 wrote to memory of 1676	1948	Woofer.exe	94
PID 1948 wrote to memory of 1676	1948	Woofer.exe	94
PID 1948 wrote to memory of 516	1948	Woofer.exe	96
PID 1948 wrote to memory of 516	1948	Woofer.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\Spoofer.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAYgBhACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAawBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGQAdgB4ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGUAdQBnACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5008
- C:\Users\Admin\AppData\Roaming\Woofer.exe
  "C:\Users\Admin\AppData\Roaming\Woofer.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Woofer.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4028
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Woofer.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5020
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\SecurityHealthSystray.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SecurityHealthSystray.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1676
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "SecurityHealthSystray" /tr "C:\Users\Admin\AppData\Roaming\SecurityHealthSystray.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Obfuscated Files or Information

1

T1027

Command Obfuscation

1

T1027.010

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
440cb38dbee06645cc8b74d51f6e5f71

SHA1
d7e61da91dc4502e9ae83281b88c1e48584edb7c

SHA256
8ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe

SHA512
3aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
34f595487e6bfd1d11c7de88ee50356a

SHA1
4caad088c15766cc0fa1f42009260e9a02f953bb

SHA256
0f9a4b52e01cb051052228a55d0515911b7ef5a8db3cf925528c746df511424d

SHA512
10976c5deaf9fac449e703e852c3b08d099f430de2d7c7b8e2525c35d63e28b890e5aab63feff9b20bca0aaf9f35a3ba411aee3fbeee9ea59f90ed25bd617a0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
9dfa3d2cb934974b14e8a756ec8a4507

SHA1
cd5a64475334c5d30d29d470fbed281e966ba5c9

SHA256
1ecb541b4f42a949757b5c75c7c04481f90d408759ede115f8279258c552b8bf

SHA512
2f3008e64ab58469dd5115dceb4bb1722be42645f11272151df5fdb2ee1c64b8b13b3f38c16c2fd0a82aa2ce7f6018fe5addba096f0168a93924e040b6901381

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a6685e02d4224799097fe9c6627fb607

SHA1
ec2d18e25513a559eed359a82c0d99e81ff41d54

SHA256
a5090285f71bb4d53010b60b446726b9257b54271c6f2e7d708ec78e335e15a9

SHA512
5e3111b2bcd3020d00d793ae3df269737ac3648d6374e18629860c455a023700f53effbc31bd3d6b5f359811de0f51a38eda248e5fd652675e6337b18cf2969e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a7cc007980e419d553568a106210549a

SHA1
c03099706b75071f36c3962fcc60a22f197711e0

SHA256
a5735921fc72189c8bf577f3911486cf031708dc8d6bc764fe3e593c0a053165

SHA512
b9aaf29403c467daef80a1ae87478afc33b78f4e1ca16189557011bb83cf9b3e29a0f85c69fa209c45201fb28baca47d31756eee07b79c6312c506e8370f7666

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ua4vjqab.pef.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Woofer.exe

Filesize
84KB

MD5
401884996ecf50f3c44e4bc55e228b3c

SHA1
8eec44a33a180a8ea816f1d07d40c396dfa243d0

SHA256
602eb973f30d7c9533eb827f3731b057e17271bcc7617c1526c9909b71baa683

SHA512
ea8b57b10ad3c569e2456c0cfedaada977db6f8dd768e15800e3af535b68299e66e3f77df613ee3a30a8bcd68a8deff315f5531ac6a40135de0a0126a28e6d08

Download Submit
memory/1948-11-0x00007FFE642D3000-0x00007FFE642D5000-memory.dmp

Filesize
8KB

Download
memory/1948-12-0x00000000003D0000-0x00000000003EC000-memory.dmp

Filesize
112KB

Download
memory/1948-113-0x000000001B070000-0x000000001B080000-memory.dmp

Filesize
64KB

Download
memory/1948-58-0x000000001B070000-0x000000001B080000-memory.dmp

Filesize
64KB

Download
memory/4028-71-0x0000025E41BC0000-0x0000025E41BE2000-memory.dmp

Filesize
136KB

Download
memory/5008-48-0x0000000075340000-0x0000000075AF0000-memory.dmp

Filesize
7.7MB

Download
memory/5008-52-0x00000000071F0000-0x0000000007286000-memory.dmp

Filesize
600KB

Download
memory/5008-32-0x0000000005C90000-0x0000000005CDC000-memory.dmp

Filesize
304KB

Download
memory/5008-34-0x00000000710E0000-0x000000007112C000-memory.dmp

Filesize
304KB

Download
memory/5008-45-0x0000000006220000-0x000000000623E000-memory.dmp

Filesize
120KB

Download
memory/5008-47-0x0000000075340000-0x0000000075AF0000-memory.dmp

Filesize
7.7MB

Download
memory/5008-46-0x0000000006C40000-0x0000000006CE3000-memory.dmp

Filesize
652KB

Download
memory/5008-35-0x0000000075340000-0x0000000075AF0000-memory.dmp

Filesize
7.7MB

Download
memory/5008-30-0x00000000057A0000-0x0000000005AF4000-memory.dmp

Filesize
3.3MB

Download
memory/5008-33-0x0000000006C00000-0x0000000006C32000-memory.dmp

Filesize
200KB

Download
memory/5008-50-0x0000000006F70000-0x0000000006F8A000-memory.dmp

Filesize
104KB

Download
memory/5008-49-0x00000000075B0000-0x0000000007C2A000-memory.dmp

Filesize
6.5MB

Download
memory/5008-51-0x0000000006FF0000-0x0000000006FFA000-memory.dmp

Filesize
40KB

Download
memory/5008-31-0x0000000005C40000-0x0000000005C5E000-memory.dmp

Filesize
120KB

Download
memory/5008-53-0x0000000007170000-0x0000000007181000-memory.dmp

Filesize
68KB

Download
memory/5008-54-0x00000000071B0000-0x00000000071BE000-memory.dmp

Filesize
56KB

Download
memory/5008-55-0x00000000071C0000-0x00000000071D4000-memory.dmp

Filesize
80KB

Download
memory/5008-56-0x00000000072B0000-0x00000000072CA000-memory.dmp

Filesize
104KB

Download
memory/5008-57-0x0000000007290000-0x0000000007298000-memory.dmp

Filesize
32KB

Download
memory/5008-20-0x0000000005630000-0x0000000005696000-memory.dmp

Filesize
408KB

Download
memory/5008-61-0x0000000075340000-0x0000000075AF0000-memory.dmp

Filesize
7.7MB

Download
memory/5008-19-0x0000000005550000-0x00000000055B6000-memory.dmp

Filesize
408KB

Download
memory/5008-18-0x0000000004D80000-0x0000000004DA2000-memory.dmp

Filesize
136KB

Download
memory/5008-17-0x0000000075340000-0x0000000075AF0000-memory.dmp

Filesize
7.7MB

Download
memory/5008-15-0x0000000004E20000-0x0000000005448000-memory.dmp

Filesize
6.2MB

Download
memory/5008-16-0x0000000075340000-0x0000000075AF0000-memory.dmp

Filesize
7.7MB

Download
memory/5008-14-0x0000000004680000-0x00000000046B6000-memory.dmp

Filesize
216KB

Download
memory/5008-13-0x000000007534E000-0x000000007534F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads