xworm | e65d7f5beb1f383e07917e867fb3b18a59a597319d152ad148b37a8924b8780d

General

Target

SamsungCommisionExternal.exe
Size

63KB
MD5

6f30a565049364df3068b5bc88fd36d6
SHA1

2ca485eb96156bfc561acd69649cf3339da6c610
SHA256

e65d7f5beb1f383e07917e867fb3b18a59a597319d152ad148b37a8924b8780d
SHA512

c01edc2fe4e5ad26b9511cc0bc114221878cf961b436a091a79611ce27da69ce7cf58afdcc71d295ad25f08701b1eb16c0c298fd22fbcb69004f760ea2b89ffe
SSDEEP

1536:9VbfG3pj8mIfpubPOggHEyj26+6POhjV5yD/9:/fGZrIf0bPDgkyjnPOhp5U9

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:24707

modified-begun.gl.at.ply.gg:24707

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/memory/4016-1-0x0000000000710000-0x0000000000726000-memory.dmp	family_xworm
behavioral1/files/0x000b000000023c82-72.dat	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2848	powershell.exe
3320	powershell.exe
4612	powershell.exe
2908	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	SamsungCommisionExternal.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smasmug.lnk	SamsungCommisionExternal.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smasmug.lnk	SamsungCommisionExternal.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Smasmug = "C:\\Users\\Admin\\AppData\\Roaming\\Smasmug"	SamsungCommisionExternal.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
2848	powershell.exe
2848	powershell.exe
3320	powershell.exe
3320	powershell.exe
4612	powershell.exe
4612	powershell.exe
2908	powershell.exe
2908	powershell.exe
4016	SamsungCommisionExternal.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	4016	SamsungCommisionExternal.exe
Token: SeDebugPrivilege	2848	powershell.exe
Token: SeDebugPrivilege	3320	powershell.exe
Token: SeDebugPrivilege	4612	powershell.exe
Token: SeDebugPrivilege	2908	powershell.exe
Token: SeDebugPrivilege	4016	SamsungCommisionExternal.exe
Token: SeDebugPrivilege	3332	taskmgr.exe
Token: SeSystemProfilePrivilege	3332	taskmgr.exe
Token: SeCreateGlobalPrivilege	3332	taskmgr.exe
Token: 33	3332	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3332	taskmgr.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4016	SamsungCommisionExternal.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 2848	4016	SamsungCommisionExternal.exe	87
PID 4016 wrote to memory of 2848	4016	SamsungCommisionExternal.exe	87
PID 4016 wrote to memory of 3320	4016	SamsungCommisionExternal.exe	89
PID 4016 wrote to memory of 3320	4016	SamsungCommisionExternal.exe	89
PID 4016 wrote to memory of 4612	4016	SamsungCommisionExternal.exe	91
PID 4016 wrote to memory of 4612	4016	SamsungCommisionExternal.exe	91
PID 4016 wrote to memory of 2908	4016	SamsungCommisionExternal.exe	93
PID 4016 wrote to memory of 2908	4016	SamsungCommisionExternal.exe	93

C:\Users\Admin\AppData\Local\Temp\SamsungCommisionExternal.exe
"C:\Users\Admin\AppData\Local\Temp\SamsungCommisionExternal.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SamsungCommisionExternal.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SamsungCommisionExternal.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Smasmug'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Smasmug'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2908

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
a43e653ffb5ab07940f4bdd9cc8fade4

SHA1
af43d04e3427f111b22dc891c5c7ee8a10ac4123

SHA256
c4c53abb13e99475aebfbe9fec7a8fead81c14c80d9dcc2b81375304f3a683fe

SHA512
62a97e95e1f19a8d4302847110dae44f469877eed6aa8ea22345c6eb25ee220e7d310fa0b7ec5df42356815421c0af7c46a0f1fee8933cc446641800eda6cd1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bdcc42d58fb72e63d2b9a1df44f6bff0

SHA1
4a5882fe86c407ca629b40655413f694c40f2325

SHA256
4808587ccfd853b94f08095bd79be4cc13a1ba993017d9a97b9b70d5b0b22455

SHA512
a812a222de3cc32132a3cf5e3e6f3cc7911b8df3ed4b18e60cf55527f321bc1ab4a9fda1925dbec5115067841ffcaf8bd772fa9ea494d81e0098545bbd193948

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
397e16d12ffae0d88086a76493713645

SHA1
010be87f7cd25efa7c4706747a5d7fbc3b4f4f61

SHA256
abbd1cbed24c4c998719e108c139dc6606f58c0d2286bac35d84634526dbef30

SHA512
7abcea1818a21dc4a1be3a0d844ef28e9b6e5fe5b9fdb3eb8c5f589ab5032bacea79cce152202b9f606dc831e6eb43cc980321a4e39b8fb126e4220d8e1935a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
7160acb949a9bd2445fc778b248be9f0

SHA1
093ebdc410c05b2e723f742fc70f21380fa52566

SHA256
c0999b067446bc532bfdd5ceb5754fa1539dba3ac1eab33b4c6562635c5901f7

SHA512
37ce82848df6bf3b862af11ad05a13161b6172a4464f20caa7a81de395c376c38096c2c9d653a3f18dfd63e4abc13c96d60963ba98527a10e127306019b64636

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_znswyhqk.zek.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smasmug.lnk

Filesize
747B

MD5
f9b15e40272fea53de121328919cf0fb

SHA1
04c57d580cda2379bf6000a3593182756ed49750

SHA256
59938c625b7388760d42ee2042aea2c73c3cba47f8fb14e17628a687d21273d4

SHA512
0be7998ce8c61d495011659be443d194953f0504e6a5eb39a5ecfb42aa4f9defa32776dc8ac2ba2362c68befd722cbf14d9f70133628a9799f6e43a6ff8f8cb5

Download Submit
C:\Users\Admin\AppData\Roaming\Smasmug

Filesize
63KB

MD5
6f30a565049364df3068b5bc88fd36d6

SHA1
2ca485eb96156bfc561acd69649cf3339da6c610

SHA256
e65d7f5beb1f383e07917e867fb3b18a59a597319d152ad148b37a8924b8780d

SHA512
c01edc2fe4e5ad26b9511cc0bc114221878cf961b436a091a79611ce27da69ce7cf58afdcc71d295ad25f08701b1eb16c0c298fd22fbcb69004f760ea2b89ffe

Download Submit
memory/2848-14-0x00007FFB76540000-0x00007FFB77001000-memory.dmp

Filesize
10.8MB

Download
memory/2848-3-0x00007FFB76540000-0x00007FFB77001000-memory.dmp

Filesize
10.8MB

Download
memory/2848-15-0x00007FFB76540000-0x00007FFB77001000-memory.dmp

Filesize
10.8MB

Download
memory/2848-18-0x00007FFB76540000-0x00007FFB77001000-memory.dmp

Filesize
10.8MB

Download
memory/2848-13-0x0000016E1EE50000-0x0000016E1EE72000-memory.dmp

Filesize
136KB

Download
memory/3332-59-0x0000021120140000-0x0000021120141000-memory.dmp

Filesize
4KB

Download
memory/3332-66-0x0000021120140000-0x0000021120141000-memory.dmp

Filesize
4KB

Download
memory/3332-64-0x0000021120140000-0x0000021120141000-memory.dmp

Filesize
4KB

Download
memory/3332-58-0x0000021120140000-0x0000021120141000-memory.dmp

Filesize
4KB

Download
memory/3332-65-0x0000021120140000-0x0000021120141000-memory.dmp

Filesize
4KB

Download
memory/3332-60-0x0000021120140000-0x0000021120141000-memory.dmp

Filesize
4KB

Download
memory/3332-70-0x0000021120140000-0x0000021120141000-memory.dmp

Filesize
4KB

Download
memory/3332-69-0x0000021120140000-0x0000021120141000-memory.dmp

Filesize
4KB

Download
memory/3332-68-0x0000021120140000-0x0000021120141000-memory.dmp

Filesize
4KB

Download
memory/3332-67-0x0000021120140000-0x0000021120141000-memory.dmp

Filesize
4KB

Download
memory/4016-56-0x00007FFB76543000-0x00007FFB76545000-memory.dmp

Filesize
8KB

Download
memory/4016-0-0x00007FFB76543000-0x00007FFB76545000-memory.dmp

Filesize
8KB

Download
memory/4016-57-0x00007FFB76540000-0x00007FFB77001000-memory.dmp

Filesize
10.8MB

Download
memory/4016-2-0x00007FFB76540000-0x00007FFB77001000-memory.dmp

Filesize
10.8MB

Download
memory/4016-1-0x0000000000710000-0x0000000000726000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads