xworm | a7ff6baaf676ce594c6f615e4c6c3dc8b9927eece059eb90c42ff36deee92add

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
01/03/2025, 10:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

safe.exe
Size

77KB
MD5

098057d58885d0eedc0af8a1c8911fd8
SHA1

9915e0e789e8b8447ab58fc8f292ba8d54739eb3
SHA256

a7ff6baaf676ce594c6f615e4c6c3dc8b9927eece059eb90c42ff36deee92add
SHA512

49aaffd1ac1d8b4254536714c7343537e308adb4bbb820ad57d0465a383f6c0ad6a9731bc06f1ae3ac39a34b383f1dc6164ae27bbb9782a9b38afe1ef96af1ea
SSDEEP

1536:z6pH/9MniZZNofb6dF+b1diDUS46KOcXSbU2dS1EAd8IIp:29MniZZNub6dF+b1dqUNOcKPgEA6IIp

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

november-cope.gl.at.ply.gg:37025

Attributes

Install_directory
%ProgramData%
install_file
update.exe

Signatures

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral1/memory/2380-1-0x0000000000970000-0x000000000098A000-memory.dmp	family_xworm
behavioral1/files/0x000d000000015d53-34.dat	family_xworm
behavioral1/memory/2140-36-0x0000000000DC0000-0x0000000000DDA000-memory.dmp	family_xworm
behavioral1/memory/1744-41-0x0000000000020000-0x000000000003A000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1360	powershell.exe
2296	powershell.exe
2548	powershell.exe
2940	powershell.exe
3000	powershell.exe
1060	powershell.exe
2276	powershell.exe
468	powershell.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update.lnk	safe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update.lnk	safe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update.lnk	update.exe

Executes dropped EXE 2 IoCs

pid	Process
2140	update.exe
1744	update.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\update = "C:\\ProgramData\\update.exe"	safe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\update = "C:\\ProgramData\\update.exe"	update.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2684	schtasks.exe
2184	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2296	powershell.exe
2548	powershell.exe
2940	powershell.exe
3000	powershell.exe
2380	safe.exe
1060	powershell.exe
2276	powershell.exe
468	powershell.exe
1360	powershell.exe
1744	update.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	2380	safe.exe
Token: SeDebugPrivilege	2296	powershell.exe
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeDebugPrivilege	2940	powershell.exe
Token: SeDebugPrivilege	3000	powershell.exe
Token: SeDebugPrivilege	2380	safe.exe
Token: SeDebugPrivilege	2140	update.exe
Token: SeDebugPrivilege	1744	update.exe
Token: SeDebugPrivilege	1060	powershell.exe
Token: SeDebugPrivilege	2276	powershell.exe
Token: SeDebugPrivilege	468	powershell.exe
Token: SeDebugPrivilege	1360	powershell.exe
Token: SeDebugPrivilege	1744	update.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2380	safe.exe
1744	update.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2296	2380	safe.exe	30
PID 2380 wrote to memory of 2296	2380	safe.exe	30
PID 2380 wrote to memory of 2296	2380	safe.exe	30
PID 2380 wrote to memory of 2548	2380	safe.exe	32
PID 2380 wrote to memory of 2548	2380	safe.exe	32
PID 2380 wrote to memory of 2548	2380	safe.exe	32
PID 2380 wrote to memory of 2940	2380	safe.exe	34
PID 2380 wrote to memory of 2940	2380	safe.exe	34
PID 2380 wrote to memory of 2940	2380	safe.exe	34
PID 2380 wrote to memory of 3000	2380	safe.exe	36
PID 2380 wrote to memory of 3000	2380	safe.exe	36
PID 2380 wrote to memory of 3000	2380	safe.exe	36
PID 2380 wrote to memory of 2684	2380	safe.exe	39
PID 2380 wrote to memory of 2684	2380	safe.exe	39
PID 2380 wrote to memory of 2684	2380	safe.exe	39
PID 2476 wrote to memory of 2140	2476	taskeng.exe	42
PID 2476 wrote to memory of 2140	2476	taskeng.exe	42
PID 2476 wrote to memory of 2140	2476	taskeng.exe	42
PID 2476 wrote to memory of 1744	2476	taskeng.exe	44
PID 2476 wrote to memory of 1744	2476	taskeng.exe	44
PID 2476 wrote to memory of 1744	2476	taskeng.exe	44
PID 1744 wrote to memory of 1060	1744	update.exe	45
PID 1744 wrote to memory of 1060	1744	update.exe	45
PID 1744 wrote to memory of 1060	1744	update.exe	45
PID 1744 wrote to memory of 2276	1744	update.exe	47
PID 1744 wrote to memory of 2276	1744	update.exe	47
PID 1744 wrote to memory of 2276	1744	update.exe	47
PID 1744 wrote to memory of 468	1744	update.exe	49
PID 1744 wrote to memory of 468	1744	update.exe	49
PID 1744 wrote to memory of 468	1744	update.exe	49
PID 1744 wrote to memory of 1360	1744	update.exe	51
PID 1744 wrote to memory of 1360	1744	update.exe	51
PID 1744 wrote to memory of 1360	1744	update.exe	51
PID 1744 wrote to memory of 2184	1744	update.exe	53
PID 1744 wrote to memory of 2184	1744	update.exe	53
PID 1744 wrote to memory of 2184	1744	update.exe	53

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\safe.exe
"C:\Users\Admin\AppData\Local\Temp\safe.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\safe.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'safe.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\update.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'update.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3000
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "update" /tr "C:\ProgramData\update.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2684

C:\Windows\system32\taskeng.exe
taskeng.exe {33B19CA2-3F97-4FC7-AADD-2302C080EEA0} S-1-5-21-677481364-2238709445-1347953534-1000:JXXXDSWS\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\ProgramData\update.exe
  C:\ProgramData\update.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2140
- C:\ProgramData\update.exe
  C:\ProgramData\update.exe
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\update.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'update.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2276
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\update.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:468
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'update.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1360
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "update" /tr "C:\ProgramData\update.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\update.exe

Filesize
77KB

MD5
098057d58885d0eedc0af8a1c8911fd8

SHA1
9915e0e789e8b8447ab58fc8f292ba8d54739eb3

SHA256
a7ff6baaf676ce594c6f615e4c6c3dc8b9927eece059eb90c42ff36deee92add

SHA512
49aaffd1ac1d8b4254536714c7343537e308adb4bbb820ad57d0465a383f6c0ad6a9731bc06f1ae3ac39a34b383f1dc6164ae27bbb9782a9b38afe1ef96af1ea

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
7d005c13e5372262b0baf09dd9f51ae0

SHA1
7cb53856a98171cfa34a51b5fc4b2fea754b2929

SHA256
c5f463cc4f4cca05191db5bb248324eb2b94ad6af146acccb55d7b4dfe0b1518

SHA512
1cced2b674e9c7700c71d805bf79f08cf641d90cc59f2fdaa42c19cb6eea70676293e19892a521542f2059164f5d4dbbb940ae53b9256bcaee8669453c46597d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
e03efcbe352ec9ebb433df7ed36ddc99

SHA1
1bd3e62a0780829e8e818a284fae73998d48f600

SHA256
e4f19817e059ffe39bdb19239777b23f00fcd51a6f2786468cb4737a04075e2a

SHA512
00550632cd812d9c8ce7270882a68bcfcd1340dcbc8383312b6bfb09d59d804f3a0aafaad7ce8565aae361cbdd1b795b35ea71711651b3951b32b2e191c9e982

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update.lnk

Filesize
628B

MD5
a77283fb7ca7dbd3cfa42a1ea9280691

SHA1
35c9bfc96a5940b7dd6478c668862494a9b34acd

SHA256
ea5714a9d2f21dd21a042e5b4a2f1cf270bea44a5fc5c9797a050001aa8ecf19

SHA512
7edbd56013713ae3e7d81f8c55da1707c917ea706bff7553d85a642ef0baac17ac3f867ecd4d3eaefc8add1dcae47b1aa4c91df7013256a5e85ade0e7dd3068a

Download Submit
memory/1060-47-0x000000001B700000-0x000000001B9E2000-memory.dmp

Filesize
2.9MB

Download
memory/1744-41-0x0000000000020000-0x000000000003A000-memory.dmp

Filesize
104KB

Download
memory/1744-69-0x0000000001F50000-0x0000000001F5A000-memory.dmp

Filesize
40KB

Download
memory/1744-68-0x0000000001F40000-0x0000000001F4C000-memory.dmp

Filesize
48KB

Download
memory/2140-36-0x0000000000DC0000-0x0000000000DDA000-memory.dmp

Filesize
104KB

Download
memory/2276-53-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/2276-54-0x00000000022E0000-0x00000000022E8000-memory.dmp

Filesize
32KB

Download
memory/2296-6-0x0000000002940000-0x00000000029C0000-memory.dmp

Filesize
512KB

Download
memory/2296-7-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/2296-8-0x00000000003F0000-0x00000000003F8000-memory.dmp

Filesize
32KB

Download
memory/2380-37-0x000007FEF5C13000-0x000007FEF5C14000-memory.dmp

Filesize
4KB

Download
memory/2380-38-0x000000001B370000-0x000000001B3F0000-memory.dmp

Filesize
512KB

Download
memory/2380-32-0x000000001B370000-0x000000001B3F0000-memory.dmp

Filesize
512KB

Download
memory/2380-1-0x0000000000970000-0x000000000098A000-memory.dmp

Filesize
104KB

Download
memory/2380-0-0x000007FEF5C13000-0x000007FEF5C14000-memory.dmp

Filesize
4KB

Download
memory/2548-15-0x0000000001FF0000-0x0000000001FF8000-memory.dmp

Filesize
32KB

Download
memory/2548-14-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download