xworm | ed2412eaee0ed2a18411fda373dbf71a90296f5866aec5af55255a487b92af12

General

Target

wub_64.exe
Size

1.1MB
MD5

3fb29133bba5f76baf2a75d7b177e33c
SHA1

b5fce8752562db3bb24ca0c7f8c3c2da73098372
SHA256

ed2412eaee0ed2a18411fda373dbf71a90296f5866aec5af55255a487b92af12
SHA512

68170e31ba3ece0ee9294f0278bc2cf54be19cd73e80a9b78cc213f327464957f0fbee9aa16781791ed45e57cc107bd4825abc7661ab75df37546576c20cb243
SSDEEP

24576:a0euAl7t8FI3YcD7ODKlLo0cKiAwWxd19LW7bXH6sv:tNAl7tN39Hns0cjWxNLW7b36

Score

10^/10

xworm defense_evasion persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

vshostupdater.duckdns.org:34357

newport1179.duckdns.org:34357

windowsbre.duckdns.org:34357

Attributes

Install_directory
%AppData%
install_file
Windows Updater.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000016c66-10.dat	family_xworm
behavioral1/memory/2376-71-0x0000000000F00000-0x0000000000F20000-memory.dmp	family_xworm

Modifies security service 2 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	Wub_x64.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Updater.lnk	Wub64x.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Updater.lnk	Wub64x.exe

Executes dropped EXE 2 IoCs

pid	Process
2732	Wub_x64.exe
2376	Wub64x.exe

Loads dropped DLL 1 IoCs

pid	Process
2556	wub_64.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Updater = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Updater.exe"	Wub64x.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2696	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2732	Wub_x64.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2376	Wub64x.exe
Token: SeDebugPrivilege	2376	Wub64x.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2732	2556	wub_64.exe	30
PID 2556 wrote to memory of 2732	2556	wub_64.exe	30
PID 2556 wrote to memory of 2732	2556	wub_64.exe	30
PID 2556 wrote to memory of 2376	2556	wub_64.exe	31
PID 2556 wrote to memory of 2376	2556	wub_64.exe	31
PID 2556 wrote to memory of 2376	2556	wub_64.exe	31
PID 2376 wrote to memory of 2696	2376	Wub64x.exe	32
PID 2376 wrote to memory of 2696	2376	Wub64x.exe	32
PID 2376 wrote to memory of 2696	2376	Wub64x.exe	32

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\wub_64.exe
"C:\Users\Admin\AppData\Local\Temp\wub_64.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Users\Admin\AppData\Roaming\Wub_x64.exe
  "C:\Users\Admin\AppData\Roaming\Wub_x64.exe"
  2⤵
  - Modifies security service
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2732
- C:\Users\Admin\AppData\Roaming\Wub64x.exe
  "C:\Users\Admin\AppData\Roaming\Wub64x.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows Updater" /tr "C:\Users\Admin\AppData\Roaming\Windows Updater.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2696

C:\Windows\system32\taskeng.exe
taskeng.exe {17716E3F-C3F5-42C2-BED9-177A6FCCC4A5} S-1-5-21-1163522206-1469769407-485553996-1000:PJCSDMRP\Admin:Interactive:[1]
1⤵
PID:1764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2t7h3c2l.tmp

Filesize
18KB

MD5
e271af82f26e2ea669c08049c4367de3

SHA1
bc27b67df570f92c72e96068ac60ae543220af0a

SHA256
7cda69a9623825130dc5a0f4b19c383197c55a93664ee4f68c2e1d201c9741f6

SHA512
b0ea7d0d35ad84634c71669d81957610fbe8a347024b3b37b5d6705792faf14c60e43b4be17a486cb0e4c24271470746c3693194cc2c7f83a8ac20d9cd69138c

Download Submit
C:\Users\Admin\AppData\Roaming\Wub.ini

Filesize
5KB

MD5
7b27794d93f1d9390dd1c8e893eb8d02

SHA1
fc244501af7e14a216ad2ca3c68cc396cdb61881

SHA256
346b9e46318d7630a2ef6ce62680debab110c0e1c658d3c63c3e2debce18f95d

SHA512
2947b204c6f45d0cff2bdb3c543d389b7d47e35205f56a62e468f1d2ea95b9d4c42204356b90626044cc116d7e7b5cb9ef311c1c3fc2dc6281e5e200985ad95f

Download Submit
C:\Users\Admin\AppData\Roaming\Wub64x.exe

Filesize
110KB

MD5
16730f8a80733a2681eeb86f0f108d98

SHA1
e562451160d20e8f398f3610ef3d1dd3307c59fd

SHA256
065e6ef1d6194ff38440c85ee9dd326c9487016a041643015b90f6226ef6a911

SHA512
94e9d478e750164e1682f17d82e7b93ff42a5b9d7e56020f13a7529aca774c74d77ce71f5f7d084bbe61cee1bc50b1589ef0cc402506098a93d3e7140680fd18

Download Submit
\Users\Admin\AppData\Roaming\Wub_x64.exe

Filesize
939KB

MD5
9d6778f7f274f7ecd4e7e875a7268b64

SHA1
452fa439f1cc0b9fcc37cf4b8cfff96e8cc348aa

SHA256
187eeee9e518011de1b87cfb0ed03e12ea551e9011f0c8defdd0e4535e672da2

SHA512
d51df55a5f903ec624550e847459bfa52fb19e892a58fe2de41251d9d98890b36f26a4950ad75f900de0311b5330066aaece11ec5e549d5b3867a61a344e0b87

Download Submit
memory/2376-71-0x0000000000F00000-0x0000000000F20000-memory.dmp

Filesize
128KB

Download
memory/2556-0-0x000007FEF53A3000-0x000007FEF53A4000-memory.dmp

Filesize
4KB

Download
memory/2556-1-0x0000000001260000-0x000000000137A000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads