xworm | a52967cd57ab936447fb9d631ea2c1caa904aa37b698ac18919d57e42017df55

General

Target

ILOADER.exe
Size

102KB
MD5

f3071053a4a5b7c6116390e2d4aed29d
SHA1

5056680a6e64137d31edfcd8a163225c642badc9
SHA256

a52967cd57ab936447fb9d631ea2c1caa904aa37b698ac18919d57e42017df55
SHA512

db7398671f2c9e49d81691edb7157f6dc98eea14e9034bbbf86a21a1ad190d4b3a04a6a640979dc3e7535e9ca4c62a68aa4df0c9d6c3f78c59724842eceb1f0d
SSDEEP

3072:H3/zbgow3dlSHbG+btjnOBQnC3GDNdZwCxaOKFmh5:H3/vgZsPbpCKGLMh

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

26.ip.gl.ply.gg:45556

Attributes

Install_directory
%AppData%
install_file
svchost.exe
telegram
https://api.telegram.org/bot7993755657:AAFO640EjOsY8e2cOR8daPzBSHn1uGW4C9s/sendMessage?chat_id=6749074492

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1868-1-0x0000000000340000-0x000000000035E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2808	powershell.exe
2868	powershell.exe
1736	powershell.exe
3044	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	ILOADER.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2808	powershell.exe
2868	powershell.exe
1736	powershell.exe
3044	powershell.exe
1868	ILOADER.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1868	ILOADER.exe
Token: SeDebugPrivilege	2808	powershell.exe
Token: SeDebugPrivilege	2868	powershell.exe
Token: SeDebugPrivilege	1736	powershell.exe
Token: SeDebugPrivilege	3044	powershell.exe
Token: SeDebugPrivilege	1868	ILOADER.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1868	ILOADER.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2808	1868	ILOADER.exe	30
PID 1868 wrote to memory of 2808	1868	ILOADER.exe	30
PID 1868 wrote to memory of 2808	1868	ILOADER.exe	30
PID 1868 wrote to memory of 2868	1868	ILOADER.exe	32
PID 1868 wrote to memory of 2868	1868	ILOADER.exe	32
PID 1868 wrote to memory of 2868	1868	ILOADER.exe	32
PID 1868 wrote to memory of 1736	1868	ILOADER.exe	34
PID 1868 wrote to memory of 1736	1868	ILOADER.exe	34
PID 1868 wrote to memory of 1736	1868	ILOADER.exe	34
PID 1868 wrote to memory of 3044	1868	ILOADER.exe	36
PID 1868 wrote to memory of 3044	1868	ILOADER.exe	36
PID 1868 wrote to memory of 3044	1868	ILOADER.exe	36

C:\Users\Admin\AppData\Local\Temp\ILOADER.exe
"C:\Users\Admin\AppData\Local\Temp\ILOADER.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ILOADER.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'ILOADER.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
e93cb6b4a6dcfb86756f374039532b5a

SHA1
7dacdc0a61019f1b7f3ba54d9efa219e90f057ae

SHA256
80e83f741c13f3393b080fc9fc09f4d18474bc3e5d50628517b07ba8775a8f1f

SHA512
3fa85b4fdfdc2ed3c8111e24a39924f020e0378f8ea1956ec3edecab231e9bfb3280d2c201a215b18e08730430179f74078bc5e810bd3ca7129b644b9239e800

Download Submit
memory/1868-0-0x000007FEF6473000-0x000007FEF6474000-memory.dmp

Filesize
4KB

Download
memory/1868-1-0x0000000000340000-0x000000000035E000-memory.dmp

Filesize
120KB

Download
memory/1868-27-0x000000001B2A0000-0x000000001B320000-memory.dmp

Filesize
512KB

Download
memory/1868-28-0x000007FEF6473000-0x000007FEF6474000-memory.dmp

Filesize
4KB

Download
memory/1868-29-0x000000001B2A0000-0x000000001B320000-memory.dmp

Filesize
512KB

Download
memory/2808-6-0x0000000002BC0000-0x0000000002C40000-memory.dmp

Filesize
512KB

Download
memory/2808-7-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/2808-8-0x0000000000560000-0x0000000000568000-memory.dmp

Filesize
32KB

Download
memory/2868-14-0x000000001B560000-0x000000001B842000-memory.dmp

Filesize
2.9MB

Download
memory/2868-15-0x0000000001FF0000-0x0000000001FF8000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads