xworm | 3b67604b47e117c1eff51c5e7c26c8258441c8b27809495cc7d0bb407fdbc377

General

Target

3b67604b47e117c1eff51c5e7c26c8258441c8b27809495cc7d0bb407fdbc377.exe
Size

62KB
MD5

d361dc014b73a322681f2fb1e83f9091
SHA1

6411e30e47b02a5ead2d3b8c98105734e2dc8915
SHA256

3b67604b47e117c1eff51c5e7c26c8258441c8b27809495cc7d0bb407fdbc377
SHA512

8ab35a0008bd184296688fac0db593069d4d37da72777b0130ed9d1a46e9eed728e4d74206941c9eb333bd21b91a4158514e888dba0dbe99af0bbbc181fc7591
SSDEEP

1536:96gXIHbI7Ef01kbhEFCJ8nm68shlOTQyAzTUk:v1kbh98n0s7OTIok

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

C2

147.185.221.24:17857

Attributes

Install_directory
%LocalAppData%

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2644-1-0x0000000000F70000-0x0000000000F86000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2744	powershell.exe
2712	powershell.exe
2548	powershell.exe
2992	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Discord.lnk	3b67604b47e117c1eff51c5e7c26c8258441c8b27809495cc7d0bb407fdbc377.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Discord.lnk	3b67604b47e117c1eff51c5e7c26c8258441c8b27809495cc7d0bb407fdbc377.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2744	powershell.exe
2712	powershell.exe
2548	powershell.exe
2992	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2644	3b67604b47e117c1eff51c5e7c26c8258441c8b27809495cc7d0bb407fdbc377.exe
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeDebugPrivilege	2712	powershell.exe
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeDebugPrivilege	2992	powershell.exe
Token: SeDebugPrivilege	2644	3b67604b47e117c1eff51c5e7c26c8258441c8b27809495cc7d0bb407fdbc377.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2744	2644	3b67604b47e117c1eff51c5e7c26c8258441c8b27809495cc7d0bb407fdbc377.exe	30
PID 2644 wrote to memory of 2744	2644	3b67604b47e117c1eff51c5e7c26c8258441c8b27809495cc7d0bb407fdbc377.exe	30
PID 2644 wrote to memory of 2744	2644	3b67604b47e117c1eff51c5e7c26c8258441c8b27809495cc7d0bb407fdbc377.exe	30
PID 2644 wrote to memory of 2712	2644	3b67604b47e117c1eff51c5e7c26c8258441c8b27809495cc7d0bb407fdbc377.exe	32
PID 2644 wrote to memory of 2712	2644	3b67604b47e117c1eff51c5e7c26c8258441c8b27809495cc7d0bb407fdbc377.exe	32
PID 2644 wrote to memory of 2712	2644	3b67604b47e117c1eff51c5e7c26c8258441c8b27809495cc7d0bb407fdbc377.exe	32
PID 2644 wrote to memory of 2548	2644	3b67604b47e117c1eff51c5e7c26c8258441c8b27809495cc7d0bb407fdbc377.exe	34
PID 2644 wrote to memory of 2548	2644	3b67604b47e117c1eff51c5e7c26c8258441c8b27809495cc7d0bb407fdbc377.exe	34
PID 2644 wrote to memory of 2548	2644	3b67604b47e117c1eff51c5e7c26c8258441c8b27809495cc7d0bb407fdbc377.exe	34
PID 2644 wrote to memory of 2992	2644	3b67604b47e117c1eff51c5e7c26c8258441c8b27809495cc7d0bb407fdbc377.exe	36
PID 2644 wrote to memory of 2992	2644	3b67604b47e117c1eff51c5e7c26c8258441c8b27809495cc7d0bb407fdbc377.exe	36
PID 2644 wrote to memory of 2992	2644	3b67604b47e117c1eff51c5e7c26c8258441c8b27809495cc7d0bb407fdbc377.exe	36

C:\Users\Admin\AppData\Local\Temp\3b67604b47e117c1eff51c5e7c26c8258441c8b27809495cc7d0bb407fdbc377.exe
"C:\Users\Admin\AppData\Local\Temp\3b67604b47e117c1eff51c5e7c26c8258441c8b27809495cc7d0bb407fdbc377.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\3b67604b47e117c1eff51c5e7c26c8258441c8b27809495cc7d0bb407fdbc377.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '3b67604b47e117c1eff51c5e7c26c8258441c8b27809495cc7d0bb407fdbc377.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Discord'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Discord'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
4550aad7b4036adedaef7155d0f39770

SHA1
4dd914cbb863c0cace8850ab68415ab421951b95

SHA256
a1e9a8bec6fb29094bc6f053153eb0da4c6e14e88943ddd341d9b9bb8f4154d1

SHA512
da791fd5876561d8f3d02f744d575d673d75136567afdbf29a5fa34431b16ebe2441186ea454180ba15bf0e321771df2ef76df4aa86efa58b5df024254e86fa6

Download Submit
memory/2644-0-0x000007FEF5433000-0x000007FEF5434000-memory.dmp

Filesize
4KB

Download
memory/2644-1-0x0000000000F70000-0x0000000000F86000-memory.dmp

Filesize
88KB

Download
memory/2644-30-0x000000001B1F0000-0x000000001B270000-memory.dmp

Filesize
512KB

Download
memory/2644-31-0x000007FEF5433000-0x000007FEF5434000-memory.dmp

Filesize
4KB

Download
memory/2644-32-0x000000001B1F0000-0x000000001B270000-memory.dmp

Filesize
512KB

Download
memory/2712-14-0x000000001B5A0000-0x000000001B882000-memory.dmp

Filesize
2.9MB

Download
memory/2712-15-0x0000000000450000-0x0000000000458000-memory.dmp

Filesize
32KB

Download
memory/2744-6-0x0000000002BA0000-0x0000000002C20000-memory.dmp

Filesize
512KB

Download
memory/2744-7-0x000000001B5A0000-0x000000001B882000-memory.dmp

Filesize
2.9MB

Download
memory/2744-8-0x0000000001F80000-0x0000000001F88000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing