xworm | b21970eb9efd571d0244356f6b6a96a612527e20b416747e8572c52d30ea5b57

General

Target

7.exe
Size

302KB
MD5

ad169b56eca575c76b5c8662eaafe750
SHA1

8856d6a0532b62af6e6f8e1f6d86bb9433ea12d2
SHA256

b21970eb9efd571d0244356f6b6a96a612527e20b416747e8572c52d30ea5b57
SHA512

cb12c03c6f37e4853349f59470caf763c21dea36d189fb46a85178779df844f6e057080c5804b6441e3a7fbcc881bf60972a88d335a0db5d4fed0997bed5387b
SSDEEP

1536:AQPS0VyRe/kqne5mcDf2c+oH5FlZn2AniQuLvyQIs+oitUKw71nztWGlSBSdkxLZ:AZ0dcEhPorlFeVABf9vtrjxlDE4

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

feb-arrested.gl.at.ply.gg:17830

Attributes

Install_directory
%Temp%
install_file
svchost.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000c000000023b3e-6.dat	family_xworm
behavioral2/memory/4648-14-0x00000000007C0000-0x00000000007F4000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2068	powershell.exe
3944	powershell.exe
1444	powershell.exe
1936	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Cloud.exe

Executes dropped EXE 2 IoCs

pid	Process
4648	Cloud.exe
1116	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe"	Cloud.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2032	timeout.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	7.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OpenWith.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1404	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4648	Cloud.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2068	powershell.exe
2068	powershell.exe
3944	powershell.exe
3944	powershell.exe
1444	powershell.exe
1444	powershell.exe
1936	powershell.exe
1936	powershell.exe
4648	Cloud.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4648	Cloud.exe
Token: SeDebugPrivilege	2068	powershell.exe
Token: SeDebugPrivilege	3944	powershell.exe
Token: SeDebugPrivilege	1444	powershell.exe
Token: SeDebugPrivilege	1936	powershell.exe
Token: SeDebugPrivilege	4648	Cloud.exe
Token: SeDebugPrivilege	1116	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4484	OpenWith.exe
4648	Cloud.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 4648	4480	7.exe	83
PID 4480 wrote to memory of 4648	4480	7.exe	83
PID 4648 wrote to memory of 2068	4648	Cloud.exe	90
PID 4648 wrote to memory of 2068	4648	Cloud.exe	90
PID 4648 wrote to memory of 3944	4648	Cloud.exe	92
PID 4648 wrote to memory of 3944	4648	Cloud.exe	92
PID 4648 wrote to memory of 1444	4648	Cloud.exe	94
PID 4648 wrote to memory of 1444	4648	Cloud.exe	94
PID 4648 wrote to memory of 1936	4648	Cloud.exe	96
PID 4648 wrote to memory of 1936	4648	Cloud.exe	96
PID 4648 wrote to memory of 1404	4648	Cloud.exe	98
PID 4648 wrote to memory of 1404	4648	Cloud.exe	98
PID 4648 wrote to memory of 3212	4648	Cloud.exe	116
PID 4648 wrote to memory of 3212	4648	Cloud.exe	116
PID 4648 wrote to memory of 1188	4648	Cloud.exe	118
PID 4648 wrote to memory of 1188	4648	Cloud.exe	118
PID 1188 wrote to memory of 2032	1188	cmd.exe	120
PID 1188 wrote to memory of 2032	1188	cmd.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7.exe
"C:\Users\Admin\AppData\Local\Temp\7.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Users\Admin\AppData\Roaming\Cloud.exe
  "C:\Users\Admin\AppData\Roaming\Cloud.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Cloud.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Cloud.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1936
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1404
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /delete /f /tn "svchost"
    3⤵
    PID:3212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp755A.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1188
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:2032

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4484

C:\Users\Admin\AppData\Local\Temp\svchost.exe
C:\Users\Admin\AppData\Local\Temp\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
731e9e4becec0b1ef9caad4b3562d4b4

SHA1
6dffb77aba4e92ad5bd4b7c02fdee6f328bcd457

SHA256
71c7eca538938fa4d5b470fee41cfe43734e9beb9ae409d5b41111fa1a15c2d5

SHA512
841cf559ae5b0feec4be43018717641399b3602a553112e98b07d498f1a44169924466abc7e2313b8e8cf1c0fdc1bb7635e2818aab8269b0ef349a0ba0cd6ae5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
60945d1a2e48da37d4ce8d9c56b6845a

SHA1
83e80a6acbeb44b68b0da00b139471f428a9d6c1

SHA256
314b91c00997034d6e015f40230d90ebbf57de5dc938b62c1a214d591793dbe3

SHA512
5d068f1d6443e26ae3cad1c80f969e50e5860967b314153c4d3b6efd1cfa39f0907c6427bec7fa43db079f258b6357e4e9a1b0b1a36b1481d2049ea0e67909ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ce4540390cc4841c8973eb5a3e9f4f7d

SHA1
2293f30a6f4c9538bc5b06606c10a50ab4ecef8e

SHA256
e834e1da338b9644d538cefd70176768816da2556939c1255d386931bd085105

SHA512
2a3e466cb5a81d2b65256053b768a98321eb3e65ff46353eefc9864f14a391748116f050e7482ddd73a51575bf0a6fc5c673023dade62dbd8b174442bae1cc6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y0xbg0xt.2bb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp755A.tmp.bat

Filesize
154B

MD5
bed522cf51f75c6bb2c467414ec2c35e

SHA1
13f7061a103b804b2ca1d8df307e21554902375f

SHA256
8c2a6167272fc0d235d00d5293b4e135840947a4d13c03e91d000cc197993b99

SHA512
d4e5e22eeaaaaa0bd8b39fa51d14dd92df2775cefc5d4a73605bd4e10c38202286b7845dd8d9e3ea6056db89b7723e80a36901b6495c90b4f2a894489cce3673

Download Submit
C:\Users\Admin\AppData\Roaming\Cloud.exe

Filesize
186KB

MD5
bea3a6d3fe25fde4a5837129ff579eff

SHA1
90ab2a9b6692a7efeec4cad65bc449d6134087d9

SHA256
6bb2751248b7d9bf1076139d5abaee7bb6473e7375827052e68b6726cd6b80b8

SHA512
34f45e59d7587ff54c45d75d6df63109cc7c886ffb3de7820ac1db8236dafa5ad489c11338314121ba9829a7803d366aeea3833fbd0e99e02cc4a1cde0ae84c7

Download Submit
memory/2068-28-0x000001C72FE90000-0x000001C72FEB2000-memory.dmp

Filesize
136KB

Download
memory/4480-0-0x00007FF998063000-0x00007FF998065000-memory.dmp

Filesize
8KB

Download
memory/4480-1-0x0000000000F90000-0x0000000000FE0000-memory.dmp

Filesize
320KB

Download
memory/4648-18-0x00007FF998060000-0x00007FF998B21000-memory.dmp

Filesize
10.8MB

Download
memory/4648-16-0x00007FF998060000-0x00007FF998B21000-memory.dmp

Filesize
10.8MB

Download
memory/4648-14-0x00000000007C0000-0x00000000007F4000-memory.dmp

Filesize
208KB

Download
memory/4648-66-0x00007FF998060000-0x00007FF998B21000-memory.dmp

Filesize
10.8MB

Download
memory/4648-73-0x00007FF998060000-0x00007FF998B21000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads