xworm | aac2bb6ed014b4e73f263b69d11ccc37fa1b94cfccacbfacc564fcead1bc9340

General

Target

aac2bb6ed014b4e73f263b69d11ccc37fa1b94cfccacbfacc564fcead1bc9340.exe
Size

190KB
MD5

180735cd524d00759a5f261123a6c0d0
SHA1

cdb05596dd091c51525e573fb061ef15bfd9ae83
SHA256

aac2bb6ed014b4e73f263b69d11ccc37fa1b94cfccacbfacc564fcead1bc9340
SHA512

9fdd5fe3dd1a01f20e524138aa4b4d2daca206d666b4978a5bf73538d0810edee81b353decbdc5fa534870c68ff5d05e8bbe9f1fec8bf6ffff6125a1dc46cf5f
SSDEEP

3072:l/Wr3qjGBaMWrmS24qBZDhAxPWUMWkZoGv/rFVHvTQINontDme41OOjluUnd2bzD:l/ckr6HBZDONv1jmHHvHNonlm+OZBe

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:7777

Mutex

tEPO2T8ayqFvBb4T

Attributes

Install_directory
%AppData%
install_file
XClient.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023b77-17.dat	family_xworm
behavioral2/memory/3740-25-0x0000000000F60000-0x0000000000F70000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
372	powershell.exe
3636	powershell.exe
4296	powershell.exe
2624	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	aac2bb6ed014b4e73f263b69d11ccc37fa1b94cfccacbfacc564fcead1bc9340.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	XClient.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe

Executes dropped EXE 2 IoCs

pid	Process
4148	Xeno.exe
3740	XClient.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
372	powershell.exe
372	powershell.exe
3636	powershell.exe
3636	powershell.exe
4296	powershell.exe
4296	powershell.exe
2624	powershell.exe
2624	powershell.exe
3740	XClient.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3740	XClient.exe
Token: SeDebugPrivilege	372	powershell.exe
Token: SeDebugPrivilege	3636	powershell.exe
Token: SeDebugPrivilege	4296	powershell.exe
Token: SeDebugPrivilege	2624	powershell.exe
Token: SeDebugPrivilege	3740	XClient.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3740	XClient.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 4148	3900	aac2bb6ed014b4e73f263b69d11ccc37fa1b94cfccacbfacc564fcead1bc9340.exe	83
PID 3900 wrote to memory of 4148	3900	aac2bb6ed014b4e73f263b69d11ccc37fa1b94cfccacbfacc564fcead1bc9340.exe	83
PID 3900 wrote to memory of 3740	3900	aac2bb6ed014b4e73f263b69d11ccc37fa1b94cfccacbfacc564fcead1bc9340.exe	84
PID 3900 wrote to memory of 3740	3900	aac2bb6ed014b4e73f263b69d11ccc37fa1b94cfccacbfacc564fcead1bc9340.exe	84
PID 3740 wrote to memory of 372	3740	XClient.exe	89
PID 3740 wrote to memory of 372	3740	XClient.exe	89
PID 3740 wrote to memory of 3636	3740	XClient.exe	91
PID 3740 wrote to memory of 3636	3740	XClient.exe	91
PID 3740 wrote to memory of 4296	3740	XClient.exe	93
PID 3740 wrote to memory of 4296	3740	XClient.exe	93
PID 3740 wrote to memory of 2624	3740	XClient.exe	95
PID 3740 wrote to memory of 2624	3740	XClient.exe	95

C:\Users\Admin\AppData\Local\Temp\aac2bb6ed014b4e73f263b69d11ccc37fa1b94cfccacbfacc564fcead1bc9340.exe
"C:\Users\Admin\AppData\Local\Temp\aac2bb6ed014b4e73f263b69d11ccc37fa1b94cfccacbfacc564fcead1bc9340.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Users\Admin\AppData\Roaming\Xeno.exe
  "C:\Users\Admin\AppData\Roaming\Xeno.exe"
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Users\Admin\AppData\Roaming\XClient.exe
  "C:\Users\Admin\AppData\Roaming\XClient.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:372
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3636
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4296
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5cfe303e798d1cc6c1dab341e7265c15

SHA1
cd2834e05191a24e28a100f3f8114d5a7708dc7c

SHA256
c4d16552769ca1762f6867bce85589c645ac3dc490b650083d74f853f898cfab

SHA512
ef151bbe0033a2caf2d40aff74855a3f42c8171e05a11c8ce93c7039d9430482c43fe93d9164ee94839aff253cad774dbf619dde9a8af38773ca66d59ac3400e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
fd98baf5a9c30d41317663898985593b

SHA1
ea300b99f723d2429d75a6c40e0838bf60f17aad

SHA256
9d97a5bbc88fdcceac25f293383f7e5ce242675460ffbfb2ee9090870c034e96

SHA512
bf4dbbd671b5d7afb326622a7c781f150860294d3dba7160330046c258c84a15981c70e50d84dc7faaa7cc8b8c90bf8df818b3f2d3806a8a3671dfe5e38fe7b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fwovwywk.swb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\XClient.exe

Filesize
40KB

MD5
7c11c3608097aa68293957a238d0f45b

SHA1
ffe743918c5bcebd8cb437585783d6f736ee17e8

SHA256
fe6be0dde482a38dae1b63b9b26dde9e45bf46ab90c42faf64006eb550e60672

SHA512
753c5343b052224c4a0bf3016150f2b9b5410ed23af292e3fc7b4dc2b26e45087eb29e091b915493199a2210e6ab0ff741dce043db9f9c6203f3ba0ea3e88298

Download Submit
C:\Users\Admin\AppData\Roaming\Xeno.exe

Filesize
140KB

MD5
f0d6a8ef8299c5f15732a011d90b0be1

SHA1
5d2e6cc0bd4f1e810808f2a284f6c2a30b21edcf

SHA256
326bae0bd1398234dcef4c3d71f00e30cc9b447fa963e21d6f29605f42bb7e5b

SHA512
5b9f1517949a7fa9fdb7413146632d21a4208dc92823b673af85963ae5cc7f827b3ba27f3e9c5554c45e726ad159aac77d30306acc3559bd8712534e41ff0f27

Download Submit
memory/372-28-0x0000019527640000-0x0000019527662000-memory.dmp

Filesize
136KB

Download
memory/3740-27-0x00007FFB290C0000-0x00007FFB29B81000-memory.dmp

Filesize
10.8MB

Download
memory/3740-26-0x00007FFB290C0000-0x00007FFB29B81000-memory.dmp

Filesize
10.8MB

Download
memory/3740-25-0x0000000000F60000-0x0000000000F70000-memory.dmp

Filesize
64KB

Download
memory/3740-75-0x00007FFB290C0000-0x00007FFB29B81000-memory.dmp

Filesize
10.8MB

Download
memory/3740-76-0x00007FFB290C0000-0x00007FFB29B81000-memory.dmp

Filesize
10.8MB

Download
memory/3900-0-0x00007FFB290C3000-0x00007FFB290C5000-memory.dmp

Filesize
8KB

Download
memory/3900-1-0x0000000000BC0000-0x0000000000BF6000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing