xworm | 150ac1fb1dfc122655f683b3ec40e672d815c03699fb68a69917eb7b8ae8373d

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
07/03/2025, 23:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

antinashook/WinRes32.exe
Size

952KB
MD5

0c7e5b83652dabf3503bf0001b329afa
SHA1

b27452eb81f2e1b2958e3a9980fe35807f01f248
SHA256

d2d26cfeffede48bad16333b3fb1098f2c713598c2eaf37f9894069fecdce2fe
SHA512

5fe40e55382ff33642d55e738106d4e8fd78d6ee9129cb693d9c6c3025cdc30d855dba09bf4f3f932ba0e483d0e18a9eb079f357ce5c60399b54c19382007854
SSDEEP

24576:g1Way//sMrF9Q0LDnjH+eQIn1J/bYbV2u6MxgndIXhagbA0Q:uyHsMrF9Q0vCeQIvTYbwu6HndIXYgbT

Score

10^/10

xworm discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Attributes

Install_directory
%Public%
install_file
svchost.exe
pastebin_url
https://pastebin.com/raw/1vj9gviK

Signatures

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral1/files/0x0007000000016b47-13.dat	family_xworm
behavioral1/memory/2140-16-0x0000000000A60000-0x0000000000A7A000-memory.dmp	family_xworm
behavioral1/memory/2184-51-0x0000000000FB0000-0x0000000000FCA000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1752	powershell.exe
2532	powershell.exe
2524	powershell.exe
2272	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	Riot.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	Riot.exe

Executes dropped EXE 4 IoCs

pid	Process
2932	WindowsServiceHost.exe
2140	Riot.exe
2184	svchost.exe
1280	svchost.exe

Loads dropped DLL 3 IoCs

pid	Process
2612	WinRes32.exe
2612	WinRes32.exe
2612	WinRes32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Public\\svchost.exe"	Riot.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	pastebin.com
5	pastebin.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRes32.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2868	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
1752	powershell.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2532	powershell.exe
2932	WindowsServiceHost.exe
2524	powershell.exe
2932	WindowsServiceHost.exe
2272	powershell.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2140	Riot.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe
2932	WindowsServiceHost.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2140	Riot.exe
Token: SeDebugPrivilege	1752	powershell.exe
Token: SeDebugPrivilege	2532	powershell.exe
Token: SeDebugPrivilege	2524	powershell.exe
Token: SeDebugPrivilege	2272	powershell.exe
Token: SeDebugPrivilege	2140	Riot.exe
Token: SeDebugPrivilege	2184	svchost.exe
Token: SeDebugPrivilege	1280	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2140	Riot.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2932	2612	WinRes32.exe	30
PID 2612 wrote to memory of 2932	2612	WinRes32.exe	30
PID 2612 wrote to memory of 2932	2612	WinRes32.exe	30
PID 2612 wrote to memory of 2932	2612	WinRes32.exe	30
PID 2612 wrote to memory of 2140	2612	WinRes32.exe	32
PID 2612 wrote to memory of 2140	2612	WinRes32.exe	32
PID 2612 wrote to memory of 2140	2612	WinRes32.exe	32
PID 2612 wrote to memory of 2140	2612	WinRes32.exe	32
PID 2140 wrote to memory of 1752	2140	Riot.exe	33
PID 2140 wrote to memory of 1752	2140	Riot.exe	33
PID 2140 wrote to memory of 1752	2140	Riot.exe	33
PID 2140 wrote to memory of 2532	2140	Riot.exe	35
PID 2140 wrote to memory of 2532	2140	Riot.exe	35
PID 2140 wrote to memory of 2532	2140	Riot.exe	35
PID 2140 wrote to memory of 2524	2140	Riot.exe	37
PID 2140 wrote to memory of 2524	2140	Riot.exe	37
PID 2140 wrote to memory of 2524	2140	Riot.exe	37
PID 2140 wrote to memory of 2272	2140	Riot.exe	39
PID 2140 wrote to memory of 2272	2140	Riot.exe	39
PID 2140 wrote to memory of 2272	2140	Riot.exe	39
PID 2140 wrote to memory of 2868	2140	Riot.exe	41
PID 2140 wrote to memory of 2868	2140	Riot.exe	41
PID 2140 wrote to memory of 2868	2140	Riot.exe	41
PID 3004 wrote to memory of 2184	3004	taskeng.exe	45
PID 3004 wrote to memory of 2184	3004	taskeng.exe	45
PID 3004 wrote to memory of 2184	3004	taskeng.exe	45
PID 3004 wrote to memory of 1280	3004	taskeng.exe	46
PID 3004 wrote to memory of 1280	3004	taskeng.exe	46
PID 3004 wrote to memory of 1280	3004	taskeng.exe	46

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\antinashook\WinRes32.exe
"C:\Users\Admin\AppData\Local\Temp\antinashook\WinRes32.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Users\Admin\AppData\Local\Temp\WindowsServiceHost.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsServiceHost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2932
- C:\Users\Admin\AppData\Local\Temp\Riot.exe
  "C:\Users\Admin\AppData\Local\Temp\Riot.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Riot.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Riot.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2532
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2272
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Public\svchost.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2868

C:\Windows\system32\taskeng.exe
taskeng.exe {5E6C2554-36F1-49ED-A0B9-C6D1F815CC4E} S-1-5-21-1163522206-1469769407-485553996-1000:PJCSDMRP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Users\Public\svchost.exe
  C:\Users\Public\svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2184
- C:\Users\Public\svchost.exe
  C:\Users\Public\svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Riot.exe

Filesize
79KB

MD5
71950ec079e71454b5d271184dd58d5d

SHA1
8d20ba26cece10021d43ebff34692e4991a00c8c

SHA256
26837090198630078059fc3a5dbafa01ba5ac223c8d380845a8a3d6368d49ccd

SHA512
9d4970ced13787823319de1903aa38f615c7390600f77d6fb013df2827d7ddff57e69750ccaa752799bba821bf7e58fd358dccf176b52d25295b68d3c044333d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
a1db5bdb3b465c095fd74a855574c2a1

SHA1
e8c65c9f8f2faee7a180215b8bcc196bdde64fdb

SHA256
69983e406d36fb4b312377d2d67406bc3b85d06ce68529db7da6a522887883ef

SHA512
a399a0042f3ffa6652404b187a672f6db2e3bb8af343c5d0c3fb63647e03af62bf4e4833bc20950a95a563f9ba4c6498e0964c2cd5afb4293a87e8ee3f9fb7f2

Download Submit
\Users\Admin\AppData\Local\Temp\WindowsServiceHost.exe

Filesize
23KB

MD5
3b5ba1d090951d3d769836223db57393

SHA1
9b31771eba4dd8c7bbccdc2a50bb6dad87e42fc4

SHA256
898ac3faf4ecaad9b2fee90a2e5545b647e260c7a3f55c40babfa3c002170a19

SHA512
959552901b232666b1c4ff75729b18952c39da5672346779d45025daae108eba7a682fc9f41b0edb94c924f0a2c349db57e3ca3dbe5adb0b44c9d1c7d0888d5d

Download Submit
memory/1752-21-0x000000001B610000-0x000000001B8F2000-memory.dmp

Filesize
2.9MB

Download
memory/1752-22-0x0000000001D80000-0x0000000001D88000-memory.dmp

Filesize
32KB

Download
memory/2140-16-0x0000000000A60000-0x0000000000A7A000-memory.dmp

Filesize
104KB

Download
memory/2140-15-0x000007FEF6443000-0x000007FEF6444000-memory.dmp

Filesize
4KB

Download
memory/2140-45-0x000007FEF6440000-0x000007FEF6E2C000-memory.dmp

Filesize
9.9MB

Download
memory/2140-46-0x000007FEF6443000-0x000007FEF6444000-memory.dmp

Filesize
4KB

Download
memory/2140-47-0x000007FEF6440000-0x000007FEF6E2C000-memory.dmp

Filesize
9.9MB

Download
memory/2184-51-0x0000000000FB0000-0x0000000000FCA000-memory.dmp

Filesize
104KB

Download
memory/2532-28-0x000000001B400000-0x000000001B6E2000-memory.dmp

Filesize
2.9MB

Download
memory/2532-29-0x00000000029A0000-0x00000000029A8000-memory.dmp

Filesize
32KB

Download