xworm | 654acd8d84aa1664fa2d38eae0aebfcc99380469ec13ced30a99261a8d2d20a1

Analysis

max time kernel
93s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
24-01-2025 23:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sora._gpj.scr
Size

120KB
MD5

6d00a564c89b3a399d499f0d28b2be48
SHA1

1d5a9e16dc43ce2ac1295c47201bbf5e340931a8
SHA256

654acd8d84aa1664fa2d38eae0aebfcc99380469ec13ced30a99261a8d2d20a1
SHA512

394d5d0216c6c6f08950cc7829f71090a0e751f1b04c35ac5850952048f5d73057724a9604a3192d84579ccc49482ffcde6e002d05fc834cba1ddc77bfbeac64
SSDEEP

1536:x0M2Mhe42I3Ytb5zzFZ9jROj88Whg+mPMOCLtx2z46pEvplVppRp2Xptp8pegphx:xrHeLISFZ9jROj+hjmPHZrwENNo

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

193.123.88.61:4444

Mutex

lUiytqUjxbuCEb6P

Attributes

Install_directory
%AppData%
install_file
host.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral3/files/0x0009000000029ed8-6.dat	family_xworm
behavioral3/memory/4400-17-0x0000000000470000-0x000000000047E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\host.lnk	LocalzTQlrCMQYF.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\host.lnk	LocalzTQlrCMQYF.exe

Executes dropped EXE 1 IoCs

pid	Process
4400	LocalzTQlrCMQYF.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4400	LocalzTQlrCMQYF.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 4400	5104	sora._gpj.scr	77
PID 5104 wrote to memory of 4400	5104	sora._gpj.scr	77

C:\Users\Admin\AppData\Local\Temp\sora._gpj.scr
"C:\Users\Admin\AppData\Local\Temp\sora._gpj.scr" /S
1⤵
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Users\Admin\AppData\LocalzTQlrCMQYF.exe
  "C:\Users\Admin\AppData\LocalzTQlrCMQYF.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalzTQlrCMQYF.exe

Filesize
34KB

MD5
7823ff0c2d9d012b8acd483266fa3220

SHA1
48dd45a58b946e813ba39777227eb7222753ee0c

SHA256
89f3cf72c657199fd32cffff7ba679bc0759bf233d3e0c4b5024e898abe2a692

SHA512
09ee81dc5044680e3c229e104cd50be7493a8adf8d9b3532a7c52308084ca76ca72ad9a60c08590a483cf20ea7a6f2ba690a7cc8192af40985dd59c8971c3d74

Download Submit
memory/4400-16-0x00007FFABB3F3000-0x00007FFABB3F5000-memory.dmp

Filesize
8KB

Download
memory/4400-17-0x0000000000470000-0x000000000047E000-memory.dmp

Filesize
56KB

Download
memory/4400-23-0x00007FFABB3F0000-0x00007FFABBEB2000-memory.dmp

Filesize
10.8MB

Download
memory/4400-24-0x00007FFABB3F0000-0x00007FFABBEB2000-memory.dmp

Filesize
10.8MB

Download
memory/5104-0-0x00007FFABDAA5000-0x00007FFABDAA6000-memory.dmp

Filesize
4KB

Download
memory/5104-1-0x00007FFABD7F0000-0x00007FFABE191000-memory.dmp

Filesize
9.6MB

Download
memory/5104-3-0x00007FFABD7F0000-0x00007FFABE191000-memory.dmp

Filesize
9.6MB

Download
memory/5104-18-0x00007FFABD7F0000-0x00007FFABE191000-memory.dmp

Filesize
9.6MB

Download