xworm | 04c4c3faca190b2279461936dce8cba4ed5b17309d5cba515dcaf34081a272a5

Analysis

max time kernel
899s
max time network
900s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
21-01-2025 21:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XClient.exe
Size

72KB
MD5

dea22b4fa292c05c7da2b58aad6fc7c8
SHA1

f51a089575ff97e8c23a94e0c482a0c648206deb
SHA256

04c4c3faca190b2279461936dce8cba4ed5b17309d5cba515dcaf34081a272a5
SHA512

8ccd3937cd215487d727d93632adedbdfdc3b21489df381bbb2ab10405aaf177a9a44ad8613506e77da4e266d227cabcef337481b267c60077ec6747a1b887ad
SSDEEP

1536:6mtdG6UedjJs5waU/qn2jasVUE9b7A0SKGwZ6m0JR0lOJenLn+Q:6H0jiurY2jasVUE9b7b10cOJeD+Q

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

publication-glossary.gl.at.ply.gg:26114

Attributes

Install_directory
%AppData%
install_file
USB.exe
telegram
https://api.telegram.org/bot7704029346:AAHPre1lXQa0UfPCpOUXJZ9UXA9mFxvH4Gk/sendMessage?chat_id=7590668020

Signatures

Detect Xworm Payload 9 IoCs

resource	yara_rule
behavioral1/memory/1672-1-0x0000000001090000-0x00000000010A8000-memory.dmp	family_xworm
behavioral1/files/0x000b000000012117-33.dat	family_xworm
behavioral1/memory/444-35-0x0000000001070000-0x0000000001088000-memory.dmp	family_xworm
behavioral1/memory/324-39-0x0000000001240000-0x0000000001258000-memory.dmp	family_xworm
behavioral1/memory/1988-46-0x0000000000230000-0x0000000000248000-memory.dmp	family_xworm
behavioral1/memory/796-48-0x0000000001140000-0x0000000001158000-memory.dmp	family_xworm
behavioral1/memory/2844-50-0x00000000000A0000-0x00000000000B8000-memory.dmp	family_xworm
behavioral1/memory/2560-52-0x0000000001250000-0x0000000001268000-memory.dmp	family_xworm
behavioral1/memory/496-54-0x00000000013E0000-0x00000000013F8000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3056	powershell.exe
2468	powershell.exe
2856	powershell.exe
2720	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\security.lnk	XClient.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\security.lnk	XClient.exe

Executes dropped EXE 15 IoCs

pid	Process
444	security
2216	security
324	security
1676	security
2464	security
864	security
2664	security
1516	security
1988	security
796	security
2844	security
2560	security
496	security
1268	security
1472	security

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\security = "C:\\Users\\Admin\\AppData\\Roaming\\security"	XClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2712	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1672	XClient.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3056	powershell.exe
2468	powershell.exe
2856	powershell.exe
2720	powershell.exe
1672	XClient.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	1672	XClient.exe
Token: SeDebugPrivilege	3056	powershell.exe
Token: SeDebugPrivilege	2468	powershell.exe
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeDebugPrivilege	2720	powershell.exe
Token: SeDebugPrivilege	1672	XClient.exe
Token: SeDebugPrivilege	444	security
Token: SeDebugPrivilege	2216	security
Token: SeDebugPrivilege	324	security
Token: SeDebugPrivilege	1676	security
Token: SeDebugPrivilege	2464	security
Token: SeDebugPrivilege	864	security
Token: SeDebugPrivilege	2664	security
Token: SeDebugPrivilege	1516	security
Token: SeDebugPrivilege	1988	security
Token: SeDebugPrivilege	796	security
Token: SeDebugPrivilege	2844	security
Token: SeDebugPrivilege	2560	security
Token: SeDebugPrivilege	496	security
Token: SeDebugPrivilege	1268	security
Token: SeDebugPrivilege	1472	security

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1672	XClient.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 3056	1672	XClient.exe	30
PID 1672 wrote to memory of 3056	1672	XClient.exe	30
PID 1672 wrote to memory of 3056	1672	XClient.exe	30
PID 1672 wrote to memory of 2468	1672	XClient.exe	32
PID 1672 wrote to memory of 2468	1672	XClient.exe	32
PID 1672 wrote to memory of 2468	1672	XClient.exe	32
PID 1672 wrote to memory of 2856	1672	XClient.exe	34
PID 1672 wrote to memory of 2856	1672	XClient.exe	34
PID 1672 wrote to memory of 2856	1672	XClient.exe	34
PID 1672 wrote to memory of 2720	1672	XClient.exe	36
PID 1672 wrote to memory of 2720	1672	XClient.exe	36
PID 1672 wrote to memory of 2720	1672	XClient.exe	36
PID 1672 wrote to memory of 2712	1672	XClient.exe	38
PID 1672 wrote to memory of 2712	1672	XClient.exe	38
PID 1672 wrote to memory of 2712	1672	XClient.exe	38
PID 3048 wrote to memory of 444	3048	taskeng.exe	43
PID 3048 wrote to memory of 444	3048	taskeng.exe	43
PID 3048 wrote to memory of 444	3048	taskeng.exe	43
PID 3048 wrote to memory of 2216	3048	taskeng.exe	44
PID 3048 wrote to memory of 2216	3048	taskeng.exe	44
PID 3048 wrote to memory of 2216	3048	taskeng.exe	44
PID 3048 wrote to memory of 324	3048	taskeng.exe	45
PID 3048 wrote to memory of 324	3048	taskeng.exe	45
PID 3048 wrote to memory of 324	3048	taskeng.exe	45
PID 3048 wrote to memory of 1676	3048	taskeng.exe	46
PID 3048 wrote to memory of 1676	3048	taskeng.exe	46
PID 3048 wrote to memory of 1676	3048	taskeng.exe	46
PID 3048 wrote to memory of 2464	3048	taskeng.exe	47
PID 3048 wrote to memory of 2464	3048	taskeng.exe	47
PID 3048 wrote to memory of 2464	3048	taskeng.exe	47
PID 3048 wrote to memory of 864	3048	taskeng.exe	48
PID 3048 wrote to memory of 864	3048	taskeng.exe	48
PID 3048 wrote to memory of 864	3048	taskeng.exe	48
PID 3048 wrote to memory of 2664	3048	taskeng.exe	49
PID 3048 wrote to memory of 2664	3048	taskeng.exe	49
PID 3048 wrote to memory of 2664	3048	taskeng.exe	49
PID 3048 wrote to memory of 1516	3048	taskeng.exe	50
PID 3048 wrote to memory of 1516	3048	taskeng.exe	50
PID 3048 wrote to memory of 1516	3048	taskeng.exe	50
PID 3048 wrote to memory of 1988	3048	taskeng.exe	51
PID 3048 wrote to memory of 1988	3048	taskeng.exe	51
PID 3048 wrote to memory of 1988	3048	taskeng.exe	51
PID 3048 wrote to memory of 796	3048	taskeng.exe	52
PID 3048 wrote to memory of 796	3048	taskeng.exe	52
PID 3048 wrote to memory of 796	3048	taskeng.exe	52
PID 3048 wrote to memory of 2844	3048	taskeng.exe	53
PID 3048 wrote to memory of 2844	3048	taskeng.exe	53
PID 3048 wrote to memory of 2844	3048	taskeng.exe	53
PID 3048 wrote to memory of 2560	3048	taskeng.exe	54
PID 3048 wrote to memory of 2560	3048	taskeng.exe	54
PID 3048 wrote to memory of 2560	3048	taskeng.exe	54
PID 3048 wrote to memory of 496	3048	taskeng.exe	55
PID 3048 wrote to memory of 496	3048	taskeng.exe	55
PID 3048 wrote to memory of 496	3048	taskeng.exe	55
PID 3048 wrote to memory of 1268	3048	taskeng.exe	56
PID 3048 wrote to memory of 1268	3048	taskeng.exe	56
PID 3048 wrote to memory of 1268	3048	taskeng.exe	56
PID 3048 wrote to memory of 1472	3048	taskeng.exe	57
PID 3048 wrote to memory of 1472	3048	taskeng.exe	57
PID 3048 wrote to memory of 1472	3048	taskeng.exe	57

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\security'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'security'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2720
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "security" /tr "C:\Users\Admin\AppData\Roaming\security"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2712

C:\Windows\system32\taskeng.exe
taskeng.exe {7AB8C36C-73B5-49E3-BB92-13B9D3F08536} S-1-5-21-1163522206-1469769407-485553996-1000:PJCSDMRP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Users\Admin\AppData\Roaming\security
  C:\Users\Admin\AppData\Roaming\security
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:444
- C:\Users\Admin\AppData\Roaming\security
  C:\Users\Admin\AppData\Roaming\security
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2216
- C:\Users\Admin\AppData\Roaming\security
  C:\Users\Admin\AppData\Roaming\security
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:324
- C:\Users\Admin\AppData\Roaming\security
  C:\Users\Admin\AppData\Roaming\security
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1676
- C:\Users\Admin\AppData\Roaming\security
  C:\Users\Admin\AppData\Roaming\security
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2464
- C:\Users\Admin\AppData\Roaming\security
  C:\Users\Admin\AppData\Roaming\security
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:864
- C:\Users\Admin\AppData\Roaming\security
  C:\Users\Admin\AppData\Roaming\security
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2664
- C:\Users\Admin\AppData\Roaming\security
  C:\Users\Admin\AppData\Roaming\security
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1516
- C:\Users\Admin\AppData\Roaming\security
  C:\Users\Admin\AppData\Roaming\security
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1988
- C:\Users\Admin\AppData\Roaming\security
  C:\Users\Admin\AppData\Roaming\security
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:796
- C:\Users\Admin\AppData\Roaming\security
  C:\Users\Admin\AppData\Roaming\security
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2844
- C:\Users\Admin\AppData\Roaming\security
  C:\Users\Admin\AppData\Roaming\security
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2560
- C:\Users\Admin\AppData\Roaming\security
  C:\Users\Admin\AppData\Roaming\security
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:496
- C:\Users\Admin\AppData\Roaming\security
  C:\Users\Admin\AppData\Roaming\security
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1268
- C:\Users\Admin\AppData\Roaming\security
  C:\Users\Admin\AppData\Roaming\security
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
58cf04d80f0adef33cac324cd7bf2755

SHA1
a0939d02688890bfb5a0feac331d94c64aabf64d

SHA256
234794f8a37bbddcc40ec1621affcb6f0a56d6af38bca81951e6fab9d7dfdfe6

SHA512
b15b95609e97a493ef2de6fc9b153cc0075304e4ff0637a64a26932c5027981f21eefcc4edd8badc498d9ae38426b813fffb8fee15ef0131034d8ba830968751

Download Submit
C:\Users\Admin\AppData\Roaming\security

Filesize
72KB

MD5
dea22b4fa292c05c7da2b58aad6fc7c8

SHA1
f51a089575ff97e8c23a94e0c482a0c648206deb

SHA256
04c4c3faca190b2279461936dce8cba4ed5b17309d5cba515dcaf34081a272a5

SHA512
8ccd3937cd215487d727d93632adedbdfdc3b21489df381bbb2ab10405aaf177a9a44ad8613506e77da4e266d227cabcef337481b267c60077ec6747a1b887ad

Download Submit
memory/324-39-0x0000000001240000-0x0000000001258000-memory.dmp

Filesize
96KB

Download
memory/444-35-0x0000000001070000-0x0000000001088000-memory.dmp

Filesize
96KB

Download
memory/496-54-0x00000000013E0000-0x00000000013F8000-memory.dmp

Filesize
96KB

Download
memory/796-48-0x0000000001140000-0x0000000001158000-memory.dmp

Filesize
96KB

Download
memory/1672-29-0x000000001B190000-0x000000001B210000-memory.dmp

Filesize
512KB

Download
memory/1672-0-0x000007FEF5FD3000-0x000007FEF5FD4000-memory.dmp

Filesize
4KB

Download
memory/1672-30-0x000007FEF5FD3000-0x000007FEF5FD4000-memory.dmp

Filesize
4KB

Download
memory/1672-31-0x000000001B190000-0x000000001B210000-memory.dmp

Filesize
512KB

Download
memory/1672-1-0x0000000001090000-0x00000000010A8000-memory.dmp

Filesize
96KB

Download
memory/1988-46-0x0000000000230000-0x0000000000248000-memory.dmp

Filesize
96KB

Download
memory/2468-15-0x00000000021E0000-0x00000000021E8000-memory.dmp

Filesize
32KB

Download
memory/2468-14-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/2560-52-0x0000000001250000-0x0000000001268000-memory.dmp

Filesize
96KB

Download
memory/2844-50-0x00000000000A0000-0x00000000000B8000-memory.dmp

Filesize
96KB

Download
memory/3056-8-0x0000000001E00000-0x0000000001E08000-memory.dmp

Filesize
32KB

Download
memory/3056-7-0x000000001B610000-0x000000001B8F2000-memory.dmp

Filesize
2.9MB

Download
memory/3056-6-0x0000000002B20000-0x0000000002BA0000-memory.dmp

Filesize
512KB

Download