xworm | d8a4682081aafd15197b375cc0c943e2aedd6b07a227ea142bb0b5f34bedfc48

General

Target

d8a4682081aafd15197b375cc0c943e2aedd6b07a227ea142bb0b5f34bedfc48.exe
Size

428KB
MD5

a96147bbeb5ef1b2a125942c494725ca
SHA1

f94fcab67111e2d597e543a06ebc32c8aa52c7d9
SHA256

d8a4682081aafd15197b375cc0c943e2aedd6b07a227ea142bb0b5f34bedfc48
SHA512

e912b92231326b0777dc4d025eb0d9d51e30261e8a8154f6251e9e1e2423cb1dd22903d0cbfb9283c9a39f04109453516bd7d0e85c8d8c757a1b9e2a7243fd57
SSDEEP

1536:Aq6RXEC8huuhoQ/t2dFDnv+bGYw5xDb4SX26FOe9RcHrUkccckcccccE:R6RshuBQkvnv+bGYwwSXdO0RcLUk

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:28543

membership-enforcement.gl.at.ply.gg:28543

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2536-1-0x0000000000DE0000-0x0000000000E50000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2736	powershell.exe
2612	powershell.exe
2628	powershell.exe
328	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	d8a4682081aafd15197b375cc0c943e2aedd6b07a227ea142bb0b5f34bedfc48.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	d8a4682081aafd15197b375cc0c943e2aedd6b07a227ea142bb0b5f34bedfc48.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	d8a4682081aafd15197b375cc0c943e2aedd6b07a227ea142bb0b5f34bedfc48.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
328	powershell.exe
2736	powershell.exe
2612	powershell.exe
2628	powershell.exe
2536	d8a4682081aafd15197b375cc0c943e2aedd6b07a227ea142bb0b5f34bedfc48.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2536	d8a4682081aafd15197b375cc0c943e2aedd6b07a227ea142bb0b5f34bedfc48.exe
Token: SeDebugPrivilege	328	powershell.exe
Token: SeDebugPrivilege	2736	powershell.exe
Token: SeDebugPrivilege	2612	powershell.exe
Token: SeDebugPrivilege	2628	powershell.exe
Token: SeDebugPrivilege	2536	d8a4682081aafd15197b375cc0c943e2aedd6b07a227ea142bb0b5f34bedfc48.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2536	d8a4682081aafd15197b375cc0c943e2aedd6b07a227ea142bb0b5f34bedfc48.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 328	2536	d8a4682081aafd15197b375cc0c943e2aedd6b07a227ea142bb0b5f34bedfc48.exe	31
PID 2536 wrote to memory of 328	2536	d8a4682081aafd15197b375cc0c943e2aedd6b07a227ea142bb0b5f34bedfc48.exe	31
PID 2536 wrote to memory of 328	2536	d8a4682081aafd15197b375cc0c943e2aedd6b07a227ea142bb0b5f34bedfc48.exe	31
PID 2536 wrote to memory of 2736	2536	d8a4682081aafd15197b375cc0c943e2aedd6b07a227ea142bb0b5f34bedfc48.exe	33
PID 2536 wrote to memory of 2736	2536	d8a4682081aafd15197b375cc0c943e2aedd6b07a227ea142bb0b5f34bedfc48.exe	33
PID 2536 wrote to memory of 2736	2536	d8a4682081aafd15197b375cc0c943e2aedd6b07a227ea142bb0b5f34bedfc48.exe	33
PID 2536 wrote to memory of 2612	2536	d8a4682081aafd15197b375cc0c943e2aedd6b07a227ea142bb0b5f34bedfc48.exe	35
PID 2536 wrote to memory of 2612	2536	d8a4682081aafd15197b375cc0c943e2aedd6b07a227ea142bb0b5f34bedfc48.exe	35
PID 2536 wrote to memory of 2612	2536	d8a4682081aafd15197b375cc0c943e2aedd6b07a227ea142bb0b5f34bedfc48.exe	35
PID 2536 wrote to memory of 2628	2536	d8a4682081aafd15197b375cc0c943e2aedd6b07a227ea142bb0b5f34bedfc48.exe	37
PID 2536 wrote to memory of 2628	2536	d8a4682081aafd15197b375cc0c943e2aedd6b07a227ea142bb0b5f34bedfc48.exe	37
PID 2536 wrote to memory of 2628	2536	d8a4682081aafd15197b375cc0c943e2aedd6b07a227ea142bb0b5f34bedfc48.exe	37

C:\Users\Admin\AppData\Local\Temp\d8a4682081aafd15197b375cc0c943e2aedd6b07a227ea142bb0b5f34bedfc48.exe
"C:\Users\Admin\AppData\Local\Temp\d8a4682081aafd15197b375cc0c943e2aedd6b07a227ea142bb0b5f34bedfc48.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\d8a4682081aafd15197b375cc0c943e2aedd6b07a227ea142bb0b5f34bedfc48.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'd8a4682081aafd15197b375cc0c943e2aedd6b07a227ea142bb0b5f34bedfc48.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
f702d084b292ab4b7c48ae3d48b40f97

SHA1
05616200b5907bddbe4696dc290b913f3fc453a3

SHA256
e8c2d600c2cbcf0b818e40564bfcadf7ba3d237bb00ce9f5647d3912d7459bfa

SHA512
3598481df4e8ea8bee59b6c2a86dcc5b54ddeb5b6b6537ad75963c0e473977800232028389dcfa3f7f2ac5498f7d78da6e8b0fa3baa7195f8f78dd6ea2621a01

Download Submit
memory/328-6-0x0000000002BA0000-0x0000000002C20000-memory.dmp

Filesize
512KB

Download
memory/328-7-0x000000001B770000-0x000000001BA52000-memory.dmp

Filesize
2.9MB

Download
memory/328-8-0x0000000000680000-0x0000000000688000-memory.dmp

Filesize
32KB

Download
memory/2536-1-0x0000000000DE0000-0x0000000000E50000-memory.dmp

Filesize
448KB

Download
memory/2536-0-0x000007FEF5DC3000-0x000007FEF5DC4000-memory.dmp

Filesize
4KB

Download
memory/2536-30-0x000000001B260000-0x000000001B2E0000-memory.dmp

Filesize
512KB

Download
memory/2536-31-0x000007FEF5DC3000-0x000007FEF5DC4000-memory.dmp

Filesize
4KB

Download
memory/2536-32-0x000000001B260000-0x000000001B2E0000-memory.dmp

Filesize
512KB

Download
memory/2736-14-0x000000001B620000-0x000000001B902000-memory.dmp

Filesize
2.9MB

Download
memory/2736-15-0x0000000001C10000-0x0000000001C18000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads