xworm | d44cd1efe9953098482be69488f24bf35c2e3662e2cc843a49b928a972eeb8a8

General

Target

UyttaClient.exe
Size

284KB
MD5

3877eb59a133bcf9745356dc794d48b9
SHA1

632f1d6ae66e5572e857cf41795b02137b1afe2e
SHA256

d44cd1efe9953098482be69488f24bf35c2e3662e2cc843a49b928a972eeb8a8
SHA512

886a3b50a01c57fb277f3fa295070195621c45c74f7d391c2507ccd4d33800ae08717f70704c79557cf880af85f242670c30cc6ee74491f329180feb264548cf
SSDEEP

3072:8siYcW3RruM0pV5nFPi0ffWZgOelgIiuM/5CxgsDnUi/H+VvtCY4InH3H8:8/Yc+B4540ffW/elQ5Ce9O+VvPNM

Score

10^/10

xworm defense_evasion discovery rat trojan

Malware Config

Extracted

Family

xworm

C2

173.31.160.10:4040

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000300000001e50a-3.dat	family_xworm
behavioral2/memory/2512-23-0x00000000002C0000-0x00000000002D6000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation	UyttaClient.exe

Executes dropped EXE 2 IoCs

pid	Process
2512	XClient.exe
3216	MonkeModManager.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
20	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UyttaClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies registry class 20 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	MonkeModManager.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	MonkeModManager.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	MonkeModManager.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	MonkeModManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	MonkeModManager.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	MonkeModManager.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	MonkeModManager.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings	MonkeModManager.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	MonkeModManager.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	MonkeModManager.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	MonkeModManager.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	MonkeModManager.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	MonkeModManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	MonkeModManager.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	MonkeModManager.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	MonkeModManager.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	MonkeModManager.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	MonkeModManager.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	MonkeModManager.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	MonkeModManager.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
952	powershell.exe
952	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2512	XClient.exe
Token: SeDebugPrivilege	952	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3216	MonkeModManager.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 952	1844	UyttaClient.exe	88
PID 1844 wrote to memory of 952	1844	UyttaClient.exe	88
PID 1844 wrote to memory of 952	1844	UyttaClient.exe	88
PID 1844 wrote to memory of 2512	1844	UyttaClient.exe	90
PID 1844 wrote to memory of 2512	1844	UyttaClient.exe	90
PID 1844 wrote to memory of 3216	1844	UyttaClient.exe	91
PID 1844 wrote to memory of 3216	1844	UyttaClient.exe	91

C:\Users\Admin\AppData\Local\Temp\UyttaClient.exe
"C:\Users\Admin\AppData\Local\Temp\UyttaClient.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHgAaABpACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHkAYQBtACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAYgBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGUAegB6ACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:952
- C:\Users\Admin\AppData\Local\Temp\XClient.exe
  "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2512
- C:\Users\Admin\AppData\Local\Temp\MonkeModManager.exe
  "C:\Users\Admin\AppData\Local\Temp\MonkeModManager.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

1

T1027

Command Obfuscation

1

T1027.010

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MonkeModManager.exe

Filesize
217KB

MD5
1d62aa3d19462f3d5575fc54159911b4

SHA1
b37eab86c0075245fcc517a280f0705f6dffb852

SHA256
6acaae0fb470790102a338e23dfe2263f31e529288e4efe51b34bca30371cb36

SHA512
78a9501d7920920577a586396e5d9e2278a7c926448c9a98d7844db9032dbd887df90d2f389fe1754bf5a2071a19dfd5d40315624923e903ef9ef6cbb214b1df

Download Submit
C:\Users\Admin\AppData\Local\Temp\XClient.exe

Filesize
61KB

MD5
67ad539d4ba13679ee8d1d08d2550222

SHA1
84e0e5f4c37f1e7bcae5fd652de76b5d12302733

SHA256
5e5102c1c1bc6f43fcf95b46816e69b37c28189043b100e762670bc81504d5bd

SHA512
c261a58e55d0d2a7dbcd27d45e9a4c39f30ee522bb50179ad0d479a9bdbccbf08d8d08663f08cc579898799f87bdfa1f2cd2ad3dd153e3aaada88c8fc3d5366c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5cxxtere.qqb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/952-44-0x00000000060B0000-0x00000000060E2000-memory.dmp

Filesize
200KB

Download
memory/952-59-0x0000000006E70000-0x0000000006E7A000-memory.dmp

Filesize
40KB

Download
memory/952-66-0x0000000007080000-0x0000000007088000-memory.dmp

Filesize
32KB

Download
memory/952-26-0x0000000002500000-0x0000000002536000-memory.dmp

Filesize
216KB

Download
memory/952-27-0x0000000074CEE000-0x0000000074CEF000-memory.dmp

Filesize
4KB

Download
memory/952-28-0x0000000004E60000-0x0000000005488000-memory.dmp

Filesize
6.2MB

Download
memory/952-29-0x0000000004B10000-0x0000000004B32000-memory.dmp

Filesize
136KB

Download
memory/952-31-0x0000000004CA0000-0x0000000004D06000-memory.dmp

Filesize
408KB

Download
memory/952-30-0x0000000004BC0000-0x0000000004C26000-memory.dmp

Filesize
408KB

Download
memory/952-65-0x0000000007130000-0x000000000714A000-memory.dmp

Filesize
104KB

Download
memory/952-41-0x00000000054C0000-0x0000000005814000-memory.dmp

Filesize
3.3MB

Download
memory/952-42-0x0000000005AD0000-0x0000000005AEE000-memory.dmp

Filesize
120KB

Download
memory/952-43-0x0000000005B10000-0x0000000005B5C000-memory.dmp

Filesize
304KB

Download
memory/952-64-0x0000000007050000-0x0000000007064000-memory.dmp

Filesize
80KB

Download
memory/952-63-0x0000000007040000-0x000000000704E000-memory.dmp

Filesize
56KB

Download
memory/952-56-0x0000000006CD0000-0x0000000006D73000-memory.dmp

Filesize
652KB

Download
memory/952-45-0x0000000074820000-0x000000007486C000-memory.dmp

Filesize
304KB

Download
memory/952-57-0x0000000007450000-0x0000000007ACA000-memory.dmp

Filesize
6.5MB

Download
memory/952-58-0x0000000006E00000-0x0000000006E1A000-memory.dmp

Filesize
104KB

Download
memory/952-55-0x0000000006CA0000-0x0000000006CBE000-memory.dmp

Filesize
120KB

Download
memory/952-60-0x0000000007090000-0x0000000007126000-memory.dmp

Filesize
600KB

Download
memory/952-61-0x0000000007000000-0x0000000007011000-memory.dmp

Filesize
68KB

Download
memory/2512-62-0x000000001B010000-0x000000001B020000-memory.dmp

Filesize
64KB

Download
memory/2512-21-0x00007FFFC1293000-0x00007FFFC1295000-memory.dmp

Filesize
8KB

Download
memory/2512-23-0x00000000002C0000-0x00000000002D6000-memory.dmp

Filesize
88KB

Download
memory/3216-24-0x000001C1A8870000-0x000001C1A88AC000-memory.dmp

Filesize
240KB

Download
memory/3216-25-0x00007FFFC1290000-0x00007FFFC1D51000-memory.dmp

Filesize
10.8MB

Download
memory/3216-69-0x00007FFFC1290000-0x00007FFFC1D51000-memory.dmp

Filesize
10.8MB

Download
memory/3216-70-0x000001C1C2EA0000-0x000001C1C3049000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing