xworm | e53bd0b8797b8c0cc32875dba3469b938eb8d1c3812b2829378cdb7d40b62654

General

Target

XClient (1).exe
Size

41KB
MD5

8ac12cc24b5ac76188fe9612dc51777e
SHA1

0c0dddf34dbf7b95e82c58fdb7cfabb80db90430
SHA256

e53bd0b8797b8c0cc32875dba3469b938eb8d1c3812b2829378cdb7d40b62654
SHA512

02c4abdc825b0d3b9a88a1d66232d6f42497b7d83c6bfc473df8efbc0350371653d3ce220409aa5968cf71396ec230dea52e3793085d1f06d2338e4360c8bc93
SSDEEP

768:LrJDweBDuOkScrbsN/x6WECAr43MkfJF5Pa9p+U6iOwhF3/ibK:pDwewicrbsN/YDRr4RF49IU6iOwv6G

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

57.128.132.221:7000

Mutex

A0pVR4huor1J3yZ3

Attributes

Install_directory
%AppData%
install_file
Win32runtime.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2192-1-0x0000000000E50000-0x0000000000E60000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2740	powershell.exe
2712	powershell.exe
2980	powershell.exe
2652	powershell.exe

Deletes itself 1 IoCs

pid	Process
2004	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Win32runtime.lnk	XClient (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Win32runtime.lnk	XClient (1).exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32runtime = "C:\\Users\\Admin\\AppData\\Roaming\\Win32runtime.exe"	XClient (1).exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2948	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1716	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2652	powershell.exe
2740	powershell.exe
2712	powershell.exe
2980	powershell.exe
2192	XClient (1).exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2192	XClient (1).exe
Token: SeDebugPrivilege	2652	powershell.exe
Token: SeDebugPrivilege	2740	powershell.exe
Token: SeDebugPrivilege	2712	powershell.exe
Token: SeDebugPrivilege	2980	powershell.exe
Token: SeDebugPrivilege	2192	XClient (1).exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2192	XClient (1).exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2652	2192	XClient (1).exe	32
PID 2192 wrote to memory of 2652	2192	XClient (1).exe	32
PID 2192 wrote to memory of 2652	2192	XClient (1).exe	32
PID 2192 wrote to memory of 2740	2192	XClient (1).exe	34
PID 2192 wrote to memory of 2740	2192	XClient (1).exe	34
PID 2192 wrote to memory of 2740	2192	XClient (1).exe	34
PID 2192 wrote to memory of 2712	2192	XClient (1).exe	36
PID 2192 wrote to memory of 2712	2192	XClient (1).exe	36
PID 2192 wrote to memory of 2712	2192	XClient (1).exe	36
PID 2192 wrote to memory of 2980	2192	XClient (1).exe	38
PID 2192 wrote to memory of 2980	2192	XClient (1).exe	38
PID 2192 wrote to memory of 2980	2192	XClient (1).exe	38
PID 2192 wrote to memory of 1716	2192	XClient (1).exe	40
PID 2192 wrote to memory of 1716	2192	XClient (1).exe	40
PID 2192 wrote to memory of 1716	2192	XClient (1).exe	40
PID 2192 wrote to memory of 1660	2192	XClient (1).exe	42
PID 2192 wrote to memory of 1660	2192	XClient (1).exe	42
PID 2192 wrote to memory of 1660	2192	XClient (1).exe	42
PID 2192 wrote to memory of 2004	2192	XClient (1).exe	44
PID 2192 wrote to memory of 2004	2192	XClient (1).exe	44
PID 2192 wrote to memory of 2004	2192	XClient (1).exe	44
PID 2004 wrote to memory of 2948	2004	cmd.exe	46
PID 2004 wrote to memory of 2948	2004	cmd.exe	46
PID 2004 wrote to memory of 2948	2004	cmd.exe	46

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XClient (1).exe
"C:\Users\Admin\AppData\Local\Temp\XClient (1).exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient (1).exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient (1).exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Win32runtime.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Win32runtime.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2980
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Win32runtime" /tr "C:\Users\Admin\AppData\Roaming\Win32runtime.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1716
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /f /tn "Win32runtime"
  2⤵
  PID:1660
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp7B77.tmp.bat""
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7B77.tmp.bat

Filesize
163B

MD5
2c4312b835e20b323fea66d8ac90c46e

SHA1
2f107017f733876dd754deaf95ff3e019e202629

SHA256
7ac2f600ad626aba07d8868890d6aa2d2449c0014294e5867fd81f8b0aeab8f6

SHA512
dacd186192c9f1f483bee40f4ee3e8a3678544a9f3849a02ced7075fb1ef00f9160c63c3b07e1698bf908beb47b932064de00a7a623c9755c888ed664814e38e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
a93553d5013d919f5c6ec2d642146f3b

SHA1
505cca03682313d57afe0668da0d4734e6b28d41

SHA256
947fed4c661a7de89fd53fb95b95829329c434e62a10003648ce8091ee7928a3

SHA512
004cfb7590aaa87d9f556088b2f609aa00a280eec95bc798d1a61db4fa69cf7efa8d83cd4bdc1b1ff8f283a1236fe39e3d3de6d65059718957d1fb8259ab8b3c

Download Submit
memory/2192-2-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

Filesize
9.9MB

Download
memory/2192-0-0x000007FEF5A13000-0x000007FEF5A14000-memory.dmp

Filesize
4KB

Download
memory/2192-28-0x000007FEF5A13000-0x000007FEF5A14000-memory.dmp

Filesize
4KB

Download
memory/2192-33-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

Filesize
9.9MB

Download
memory/2192-1-0x0000000000E50000-0x0000000000E60000-memory.dmp

Filesize
64KB

Download
memory/2192-45-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

Filesize
9.9MB

Download
memory/2652-7-0x00000000029B0000-0x0000000002A30000-memory.dmp

Filesize
512KB

Download
memory/2652-8-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

Filesize
2.9MB

Download
memory/2652-9-0x0000000001F40000-0x0000000001F48000-memory.dmp

Filesize
32KB

Download
memory/2740-15-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/2740-16-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads