xworm | e65d7f5beb1f383e07917e867fb3b18a59a597319d152ad148b37a8924b8780d

General

Target

SamsungCommisionExternal.exe
Size

63KB
MD5

6f30a565049364df3068b5bc88fd36d6
SHA1

2ca485eb96156bfc561acd69649cf3339da6c610
SHA256

e65d7f5beb1f383e07917e867fb3b18a59a597319d152ad148b37a8924b8780d
SHA512

c01edc2fe4e5ad26b9511cc0bc114221878cf961b436a091a79611ce27da69ce7cf58afdcc71d295ad25f08701b1eb16c0c298fd22fbcb69004f760ea2b89ffe
SSDEEP

1536:9VbfG3pj8mIfpubPOggHEyj26+6POhjV5yD/9:/fGZrIf0bPDgkyjnPOhp5U9

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:24707

modified-begun.gl.at.ply.gg:24707

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4776-1-0x00000000000F0000-0x0000000000106000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
704	powershell.exe
3820	powershell.exe
2992	powershell.exe
2472	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smasmug.lnk	SamsungCommisionExternal.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smasmug.lnk	SamsungCommisionExternal.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Smasmug = "C:\\Users\\Admin\\AppData\\Roaming\\Smasmug"	SamsungCommisionExternal.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
704	powershell.exe
704	powershell.exe
3820	powershell.exe
3820	powershell.exe
2992	powershell.exe
2992	powershell.exe
2472	powershell.exe
2472	powershell.exe
4776	SamsungCommisionExternal.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4776	SamsungCommisionExternal.exe
Token: SeDebugPrivilege	704	powershell.exe
Token: SeDebugPrivilege	3820	powershell.exe
Token: SeDebugPrivilege	2992	powershell.exe
Token: SeDebugPrivilege	2472	powershell.exe
Token: SeDebugPrivilege	4776	SamsungCommisionExternal.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4776	SamsungCommisionExternal.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 704	4776	SamsungCommisionExternal.exe	78
PID 4776 wrote to memory of 704	4776	SamsungCommisionExternal.exe	78
PID 4776 wrote to memory of 3820	4776	SamsungCommisionExternal.exe	80
PID 4776 wrote to memory of 3820	4776	SamsungCommisionExternal.exe	80
PID 4776 wrote to memory of 2992	4776	SamsungCommisionExternal.exe	82
PID 4776 wrote to memory of 2992	4776	SamsungCommisionExternal.exe	82
PID 4776 wrote to memory of 2472	4776	SamsungCommisionExternal.exe	84
PID 4776 wrote to memory of 2472	4776	SamsungCommisionExternal.exe	84

C:\Users\Admin\AppData\Local\Temp\SamsungCommisionExternal.exe
"C:\Users\Admin\AppData\Local\Temp\SamsungCommisionExternal.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SamsungCommisionExternal.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SamsungCommisionExternal.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Smasmug'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Smasmug'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f872f6c9232f591431202b641ba1ded

SHA1
a7623c472df4bab5ad67cc09ed7ea4937ee16575

SHA256
ab03f8e51cc9b874fc797646edeb914f38e1ea06fa2e88fabc17f058512877e1

SHA512
d7b5490002bbe77de860fa63c9bcdbdb5df90172ddea776baeb9d142ec06d788636bc3db15eed2180601cf918a528e19150b6e4d7f69a095722515513934917b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
34c8b93dd58a4703db0d6dd86bb21d70

SHA1
b53aa49b882070b857951b6638d6da3a03ac2f56

SHA256
34b95e4d12196f68f7a030b98190fda89c34b696251ab9ed831e48d983896898

SHA512
bba4a86b8a66104ed21fd58717168cdf68b93c801a94ec65e25c2b66c1b9354b9e7c1c01cadde451948e072d96c3fa4994c94ef33aeff9b603e7b5d82f7111e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
f8c40f7624e23fa92ae2f41e34cfca77

SHA1
20e742cfe2759ac2adbc16db736a9e143ca7b677

SHA256
c51a52818a084addbfa913d2bb4bb2b0e60c287a4cf98e679f18b8a521c0aa7b

SHA512
f1da3ec61403d788d417d097a7ed2947203c6bff3cf1d35d697c31edecdf04710b3e44b2aa263b886e297b2ce923fea410ccc673261928f1d0cd81252740dbe7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xscz3ynq.hg2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/704-4-0x00007FFF71D20000-0x00007FFF727E2000-memory.dmp

Filesize
10.8MB

Download
memory/704-13-0x000001CDFED40000-0x000001CDFED62000-memory.dmp

Filesize
136KB

Download
memory/704-14-0x00007FFF71D20000-0x00007FFF727E2000-memory.dmp

Filesize
10.8MB

Download
memory/704-15-0x00007FFF71D20000-0x00007FFF727E2000-memory.dmp

Filesize
10.8MB

Download
memory/704-18-0x00007FFF71D20000-0x00007FFF727E2000-memory.dmp

Filesize
10.8MB

Download
memory/704-3-0x00007FFF71D20000-0x00007FFF727E2000-memory.dmp

Filesize
10.8MB

Download
memory/4776-0-0x00007FFF71D23000-0x00007FFF71D25000-memory.dmp

Filesize
8KB

Download
memory/4776-2-0x00007FFF71D20000-0x00007FFF727E2000-memory.dmp

Filesize
10.8MB

Download
memory/4776-1-0x00000000000F0000-0x0000000000106000-memory.dmp

Filesize
88KB

Download
memory/4776-50-0x00007FFF71D23000-0x00007FFF71D25000-memory.dmp

Filesize
8KB

Download
memory/4776-54-0x00007FFF71D20000-0x00007FFF727E2000-memory.dmp

Filesize
10.8MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads