xworm | c352c942b6df33510094c7100fb9d48e36b8e1e2af40a60ccc360b58721c2390

Resubmissions

06/03/2025, 15:32

250306-syztyssmz2 10

06/03/2025, 15:00

250306-sdfwca1r18 10

Analysis

max time kernel
900s
max time network
669s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
06/03/2025, 15:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15415145.exe
Size

59KB
MD5

6c091ad6fae0fa76f44870d1a1b05cb4
SHA1

040f60c0ee3f4902f919025057e34ab4d11b1abd
SHA256

c352c942b6df33510094c7100fb9d48e36b8e1e2af40a60ccc360b58721c2390
SHA512

3a414f40f99e5847d9631c4ac1143c76e77db7ae42dd8c7aed2ebf1742ec73bb802d54d6cbde3b04f6b894a4cf731aa4e9dbad95166bade13f787b489d8e8d86
SSDEEP

1536:skyZtyUQ8sBkROLW+UzbTH3gfm2qt0OgSko7:skItfQ8sBkROUzbTQf+6OgK7

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

3.1

known-savage.gl.at.ply.gg:45116

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/memory/1372-1-0x0000000000410000-0x0000000000426000-memory.dmp	family_xworm
behavioral2/files/0x002700000002a398-8.dat	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\15415145.lnk	15415145.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\15415145.lnk	15415145.exe

Executes dropped EXE 11 IoCs

pid	Process
2140	15415145.exe
2156	15415145.exe
4952	15415145.exe
3076	15415145.exe
1928	15415145.exe
3084	15415145.exe
3920	15415145.exe
1512	15415145.exe
2492	15415145.exe
4600	15415145.exe
2588	15415145.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Software\Microsoft\Windows\CurrentVersion\Run\15415145 = "C:\\Users\\Admin\\AppData\\Roaming\\15415145.exe"	15415145.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "6"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2884	schtasks.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
3172	Process not Found
244	Process not Found
4548	Process not Found
3444	Process not Found
3344	Process not Found
3860	Process not Found
3252	Process not Found
3880	Process not Found
772	Process not Found
204	Process not Found
804	Process not Found
4488	Process not Found
3008	Process not Found
4068	Process not Found
920	Process not Found
736	Process not Found
3244	Process not Found
3728	Process not Found
776	Process not Found
3588	Process not Found
4712	Process not Found
1176	Process not Found
3088	Process not Found
5040	Process not Found
1500	Process not Found
4224	Process not Found
440	Process not Found
1212	Process not Found
4756	Process not Found
4688	Process not Found
4624	Process not Found
4628	Process not Found
1964	Process not Found
3620	Process not Found
3540	Process not Found
1592	Process not Found
1224	Process not Found
2728	Process not Found
5028	Process not Found
2804	Process not Found
4976	Process not Found
4264	Process not Found
1104	Process not Found
1972	Process not Found
2416	Process not Found
2852	Process not Found
340	Process not Found
2596	Process not Found
2176	Process not Found
4388	Process not Found
1512	Process not Found
3688	Process not Found
1316	Process not Found
4880	Process not Found
444	Process not Found
2448	Process not Found
468	Process not Found
5068	Process not Found
448	Process not Found
1596	Process not Found
4952	Process not Found
1484	Process not Found
2204	Process not Found
3392	Process not Found

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	1372	15415145.exe
Token: SeDebugPrivilege	1372	15415145.exe
Token: SeDebugPrivilege	2140	15415145.exe
Token: SeDebugPrivilege	2156	15415145.exe
Token: SeDebugPrivilege	4952	15415145.exe
Token: SeDebugPrivilege	3076	15415145.exe
Token: SeDebugPrivilege	1928	15415145.exe
Token: SeDebugPrivilege	3084	15415145.exe
Token: SeDebugPrivilege	3920	15415145.exe
Token: SeDebugPrivilege	1512	15415145.exe
Token: SeDebugPrivilege	2492	15415145.exe
Token: SeDebugPrivilege	4600	15415145.exe
Token: SeDebugPrivilege	2588	15415145.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2784	LogonUI.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 2884	1372	15415145.exe	81
PID 1372 wrote to memory of 2884	1372	15415145.exe	81
PID 1372 wrote to memory of 2420	1372	15415145.exe	95
PID 1372 wrote to memory of 2420	1372	15415145.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\15415145.exe
"C:\Users\Admin\AppData\Local\Temp\15415145.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "15415145" /tr "C:\Users\Admin\AppData\Roaming\15415145.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2884
- C:\Windows\SYSTEM32\shutdown.exe
  shutdown.exe -L
  2⤵
  PID:2420

C:\Users\Admin\AppData\Roaming\15415145.exe
C:\Users\Admin\AppData\Roaming\15415145.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2140

C:\Users\Admin\AppData\Roaming\15415145.exe
C:\Users\Admin\AppData\Roaming\15415145.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2156

C:\Users\Admin\AppData\Roaming\15415145.exe
C:\Users\Admin\AppData\Roaming\15415145.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4952

C:\Users\Admin\AppData\Roaming\15415145.exe
C:\Users\Admin\AppData\Roaming\15415145.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3076

C:\Users\Admin\AppData\Roaming\15415145.exe
C:\Users\Admin\AppData\Roaming\15415145.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1928

C:\Users\Admin\AppData\Roaming\15415145.exe
C:\Users\Admin\AppData\Roaming\15415145.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3084

C:\Users\Admin\AppData\Roaming\15415145.exe
C:\Users\Admin\AppData\Roaming\15415145.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3920

C:\Users\Admin\AppData\Roaming\15415145.exe
C:\Users\Admin\AppData\Roaming\15415145.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1512

C:\Users\Admin\AppData\Roaming\15415145.exe
C:\Users\Admin\AppData\Roaming\15415145.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2492

C:\Users\Admin\AppData\Roaming\15415145.exe
C:\Users\Admin\AppData\Roaming\15415145.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4600

C:\Users\Admin\AppData\Roaming\15415145.exe
C:\Users\Admin\AppData\Roaming\15415145.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2588

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a1e855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\15415145.exe.log

Filesize
654B

MD5
2cbbb74b7da1f720b48ed31085cbd5b8

SHA1
79caa9a3ea8abe1b9c4326c3633da64a5f724964

SHA256
e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

SHA512
ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

Download Submit
C:\Users\Admin\AppData\Roaming\15415145.exe

Filesize
59KB

MD5
6c091ad6fae0fa76f44870d1a1b05cb4

SHA1
040f60c0ee3f4902f919025057e34ab4d11b1abd

SHA256
c352c942b6df33510094c7100fb9d48e36b8e1e2af40a60ccc360b58721c2390

SHA512
3a414f40f99e5847d9631c4ac1143c76e77db7ae42dd8c7aed2ebf1742ec73bb802d54d6cbde3b04f6b894a4cf731aa4e9dbad95166bade13f787b489d8e8d86

Download Submit
memory/1372-0-0x00007FFDAB213000-0x00007FFDAB215000-memory.dmp

Filesize
8KB

Download
memory/1372-1-0x0000000000410000-0x0000000000426000-memory.dmp

Filesize
88KB

Download
memory/1372-10-0x00007FFDAB210000-0x00007FFDABCD2000-memory.dmp

Filesize
10.8MB

Download
memory/1372-11-0x00007FFDAB213000-0x00007FFDAB215000-memory.dmp

Filesize
8KB

Download
memory/1372-12-0x00007FFDAB210000-0x00007FFDABCD2000-memory.dmp

Filesize
10.8MB

Download
memory/1372-13-0x000000001B130000-0x000000001B13A000-memory.dmp

Filesize
40KB

Download
memory/1372-31-0x00007FFDAB210000-0x00007FFDABCD2000-memory.dmp

Filesize
10.8MB

Download
memory/2140-16-0x00007FFDAB210000-0x00007FFDABCD2000-memory.dmp

Filesize
10.8MB

Download
memory/2140-19-0x00007FFDAB210000-0x00007FFDABCD2000-memory.dmp

Filesize
10.8MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads