xworm | 4deca80bc20e7a16190cff0d2c894d8678e710fe1cee7a28fb61cdfdc7b9a88d

General

Target

Phantom.exe
Size

1.5MB
MD5

c8eb9ad69f090d39291de91ff63171e0
SHA1

51826a1d888fc0cc994c7f2279bab39d80ef4f29
SHA256

4deca80bc20e7a16190cff0d2c894d8678e710fe1cee7a28fb61cdfdc7b9a88d
SHA512

8309328bf435465d29d26ed454e4ea3ef9c081eca03253d56d3a5477d50351e8b15dad5fb5e4e649468e82c391d357aac81272fdd6fdb62ab1ac6d97e6f1ad90
SSDEEP

24576:Py6npUwRD6G3rXKkwm07DtEJNly8fW7N93zNcbTGWIhoWj26Ks4Ta7TflBypJQkg:5iaD93rMmrM8fa3KbTGphriy3fb9b

Score

10^/10

xworm discovery persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

round-nonprofit.gl.at.ply.gg:40484

Attributes

Install_directory
%AppData%
install_file
svchost.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000016edc-17.dat	family_xworm
behavioral1/memory/2224-19-0x0000000001210000-0x0000000001226000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe

Executes dropped EXE 3 IoCs

pid	Process
2776	jizz's loader.exe
2708	Phantom.exe
2224	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	svchost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
5	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phantom.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1192	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2988	schtasks.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2224	svchost.exe
Token: SeDebugPrivilege	2708	Phantom.exe
Token: SeDebugPrivilege	2224	svchost.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2776	2396	Phantom.exe	30
PID 2396 wrote to memory of 2776	2396	Phantom.exe	30
PID 2396 wrote to memory of 2776	2396	Phantom.exe	30
PID 2396 wrote to memory of 2708	2396	Phantom.exe	31
PID 2396 wrote to memory of 2708	2396	Phantom.exe	31
PID 2396 wrote to memory of 2708	2396	Phantom.exe	31
PID 2396 wrote to memory of 2708	2396	Phantom.exe	31
PID 2776 wrote to memory of 2224	2776	jizz's loader.exe	32
PID 2776 wrote to memory of 2224	2776	jizz's loader.exe	32
PID 2776 wrote to memory of 2224	2776	jizz's loader.exe	32
PID 2224 wrote to memory of 2988	2224	svchost.exe	33
PID 2224 wrote to memory of 2988	2224	svchost.exe	33
PID 2224 wrote to memory of 2988	2224	svchost.exe	33
PID 2224 wrote to memory of 1736	2224	svchost.exe	36
PID 2224 wrote to memory of 1736	2224	svchost.exe	36
PID 2224 wrote to memory of 1736	2224	svchost.exe	36
PID 2224 wrote to memory of 2300	2224	svchost.exe	38
PID 2224 wrote to memory of 2300	2224	svchost.exe	38
PID 2224 wrote to memory of 2300	2224	svchost.exe	38
PID 2300 wrote to memory of 1192	2300	cmd.exe	40
PID 2300 wrote to memory of 1192	2300	cmd.exe	40
PID 2300 wrote to memory of 1192	2300	cmd.exe	40

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Phantom.exe
"C:\Users\Admin\AppData\Local\Temp\Phantom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Users\Admin\AppData\Roaming\jizz's loader.exe
  "C:\Users\Admin\AppData\Roaming\jizz's loader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2224
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2988
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /delete /f /tn "svchost"
      4⤵
      PID:1736
  - - C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp3E86.tmp.bat""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2300
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:1192
- C:\Users\Admin\AppData\Roaming\Phantom.exe
  "C:\Users\Admin\AppData\Roaming\Phantom.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3E86.tmp.bat

Filesize
156B

MD5
11d0a684a5a37b74d1849ee24bed4e4d

SHA1
21ce5a96385e3b2d298b40e6313acd49dc2a94ea

SHA256
973d30c27a145a09fbf252dff261ea35adb2f9fb9c176a03a4e9ea0e6566cb58

SHA512
64476145942e603787c893f865c1c2173ccea99bd83b916db44387926c03abb58482744cf6b34875ac28800fddbe73a21b9e2a6b5610820ccb9b65d0a8c33aa6

Download Submit
C:\Users\Admin\AppData\Roaming\Phantom.exe

Filesize
1.5MB

MD5
77447f97bedafe2dc903866ad18e25d6

SHA1
aef3c31376a39c2fff32a5c0ee7807257e9f6108

SHA256
2d32e99c12044e303025702f893ff65cf9a1a3cbc4991129f8188ee055d943f4

SHA512
8cd0760429bc259fe3ac7712af143e60e432e27be958f9ff0a1d73ad1d8298dd45137ba06bdda506f3fba930dff905a2c7b814045a25ca081cf930f565976475

Download Submit
C:\Users\Admin\AppData\Roaming\jizz's loader.exe

Filesize
78KB

MD5
c9dd066e7b21a78393bb547adbe4f38f

SHA1
a3fc2a840eead4af2fc464911260453e4a14f994

SHA256
fc9ef9508387625cff63c5f8c0d5b5ad4de53b8fbb34635ad25c28d39699141b

SHA512
9b5aced1112dd5f3b788b5ba77433276792dea4756b9ee3b23f6bba4fa9a497bbb8bb89feba7ade64bf04f75b406f2103dc869ccdf5ab2358313182482ab827f

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
62KB

MD5
d18614c2a9514e8825b25963c5d51a60

SHA1
3cd489a3124342799f060f0360695d13cb82d97f

SHA256
15cda14377855427b45751af2c986500f59d9baebbee852b2fdee8352cd73aed

SHA512
f3bf42facb41f6fa2e614e01149870cfdc817d75ccba7596e319a9d8261329816e992fecd5d8ba49586d7b635b26b6d357d28427b6a808ad8b8f3ae7a0e78a12

Download Submit
memory/2224-19-0x0000000001210000-0x0000000001226000-memory.dmp

Filesize
88KB

Download
memory/2396-0-0x000007FEF5433000-0x000007FEF5434000-memory.dmp

Filesize
4KB

Download
memory/2396-1-0x0000000000B20000-0x0000000000CB2000-memory.dmp

Filesize
1.6MB

Download
memory/2708-20-0x0000000001190000-0x000000000130A000-memory.dmp

Filesize
1.5MB

Download
memory/2708-22-0x0000000005F10000-0x0000000005FC0000-memory.dmp

Filesize
704KB

Download
memory/2776-13-0x0000000000010000-0x000000000002A000-memory.dmp

Filesize
104KB

Download
memory/2776-21-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads