xworm | 4deca80bc20e7a16190cff0d2c894d8678e710fe1cee7a28fb61cdfdc7b9a88d

General

Target

Phantom.exe
Size

1.5MB
MD5

c8eb9ad69f090d39291de91ff63171e0
SHA1

51826a1d888fc0cc994c7f2279bab39d80ef4f29
SHA256

4deca80bc20e7a16190cff0d2c894d8678e710fe1cee7a28fb61cdfdc7b9a88d
SHA512

8309328bf435465d29d26ed454e4ea3ef9c081eca03253d56d3a5477d50351e8b15dad5fb5e4e649468e82c391d357aac81272fdd6fdb62ab1ac6d97e6f1ad90
SSDEEP

24576:Py6npUwRD6G3rXKkwm07DtEJNly8fW7N93zNcbTGWIhoWj26Ks4Ta7TflBypJQkg:5iaD93rMmrM8fa3KbTGphriy3fb9b

Score

10^/10

xworm discovery persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

round-nonprofit.gl.at.ply.gg:40484

Attributes

Install_directory
%AppData%
install_file
svchost.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023c67-36.dat	family_xworm
behavioral2/memory/4836-39-0x0000000000170000-0x0000000000186000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	jizz's loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	Phantom.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe

Executes dropped EXE 3 IoCs

pid	Process
4124	jizz's loader.exe
2196	Phantom.exe
4836	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	svchost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
13	raw.githubusercontent.com
12	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phantom.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2032	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3316	schtasks.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4836	svchost.exe
Token: SeDebugPrivilege	2196	Phantom.exe
Token: SeDebugPrivilege	4836	svchost.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 4124	4048	Phantom.exe	83
PID 4048 wrote to memory of 4124	4048	Phantom.exe	83
PID 4048 wrote to memory of 2196	4048	Phantom.exe	84
PID 4048 wrote to memory of 2196	4048	Phantom.exe	84
PID 4048 wrote to memory of 2196	4048	Phantom.exe	84
PID 4124 wrote to memory of 4836	4124	jizz's loader.exe	85
PID 4124 wrote to memory of 4836	4124	jizz's loader.exe	85
PID 4836 wrote to memory of 3316	4836	svchost.exe	87
PID 4836 wrote to memory of 3316	4836	svchost.exe	87
PID 4836 wrote to memory of 4540	4836	svchost.exe	102
PID 4836 wrote to memory of 4540	4836	svchost.exe	102
PID 4836 wrote to memory of 3568	4836	svchost.exe	104
PID 4836 wrote to memory of 3568	4836	svchost.exe	104
PID 3568 wrote to memory of 2032	3568	cmd.exe	106
PID 3568 wrote to memory of 2032	3568	cmd.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Phantom.exe
"C:\Users\Admin\AppData\Local\Temp\Phantom.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Users\Admin\AppData\Roaming\jizz's loader.exe
  "C:\Users\Admin\AppData\Roaming\jizz's loader.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4836
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3316
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /delete /f /tn "svchost"
      4⤵
      PID:4540
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF8B.tmp.bat""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3568
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:2032
- C:\Users\Admin\AppData\Roaming\Phantom.exe
  "C:\Users\Admin\AppData\Roaming\Phantom.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF8B.tmp.bat

Filesize
155B

MD5
fa07f1efe6ce6456d1693668464d48d0

SHA1
16b742116659a6097ff7439454fc7cc6db24b110

SHA256
8ed405ea1e57734cfa2a80a160f9c2e5ca260f5d86743333507c66579b4ff048

SHA512
e35427c60646ebf9c3a6818e5e6e0de107d93f185d6ac074ee24d2adb5cf9c7cce00e23105ec79e849a793a7560df180276ad03fe5164d966cf1418f98a2bab4

Download Submit
C:\Users\Admin\AppData\Roaming\Phantom.exe

Filesize
1.5MB

MD5
77447f97bedafe2dc903866ad18e25d6

SHA1
aef3c31376a39c2fff32a5c0ee7807257e9f6108

SHA256
2d32e99c12044e303025702f893ff65cf9a1a3cbc4991129f8188ee055d943f4

SHA512
8cd0760429bc259fe3ac7712af143e60e432e27be958f9ff0a1d73ad1d8298dd45137ba06bdda506f3fba930dff905a2c7b814045a25ca081cf930f565976475

Download Submit
C:\Users\Admin\AppData\Roaming\jizz's loader.exe

Filesize
78KB

MD5
c9dd066e7b21a78393bb547adbe4f38f

SHA1
a3fc2a840eead4af2fc464911260453e4a14f994

SHA256
fc9ef9508387625cff63c5f8c0d5b5ad4de53b8fbb34635ad25c28d39699141b

SHA512
9b5aced1112dd5f3b788b5ba77433276792dea4756b9ee3b23f6bba4fa9a497bbb8bb89feba7ade64bf04f75b406f2103dc869ccdf5ab2358313182482ab827f

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
62KB

MD5
d18614c2a9514e8825b25963c5d51a60

SHA1
3cd489a3124342799f060f0360695d13cb82d97f

SHA256
15cda14377855427b45751af2c986500f59d9baebbee852b2fdee8352cd73aed

SHA512
f3bf42facb41f6fa2e614e01149870cfdc817d75ccba7596e319a9d8261329816e992fecd5d8ba49586d7b635b26b6d357d28427b6a808ad8b8f3ae7a0e78a12

Download Submit
memory/2196-40-0x0000000000A80000-0x0000000000BFA000-memory.dmp

Filesize
1.5MB

Download
memory/2196-42-0x0000000005CA0000-0x0000000006244000-memory.dmp

Filesize
5.6MB

Download
memory/2196-43-0x0000000005490000-0x0000000005522000-memory.dmp

Filesize
584KB

Download
memory/2196-44-0x0000000005650000-0x000000000565A000-memory.dmp

Filesize
40KB

Download
memory/2196-45-0x0000000006760000-0x0000000006810000-memory.dmp

Filesize
704KB

Download
memory/4048-0-0x00007FFA484F3000-0x00007FFA484F5000-memory.dmp

Filesize
8KB

Download
memory/4048-1-0x0000000000840000-0x00000000009D2000-memory.dmp

Filesize
1.6MB

Download
memory/4124-23-0x0000000000200000-0x000000000021A000-memory.dmp

Filesize
104KB

Download
memory/4124-27-0x00007FFA484F0000-0x00007FFA48FB1000-memory.dmp

Filesize
10.8MB

Download
memory/4124-41-0x00007FFA484F0000-0x00007FFA48FB1000-memory.dmp

Filesize
10.8MB

Download
memory/4836-39-0x0000000000170000-0x0000000000186000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads