xworm | 213f8f74208577665d8eba6e082166a4f7c69bccf53439a78352262aff155856

General

Target

steamtools.exe
Size

16.5MB
MD5

97592018d4745ddb6f4881afbeaab229
SHA1

f72f7b9b3a17ca5df104196b13faa561f323d3c4
SHA256

213f8f74208577665d8eba6e082166a4f7c69bccf53439a78352262aff155856
SHA512

6f259dd64ecdf97dba0e0a581cc8b664e1fcc2d1c64e94b4654b83e6631264614f14f88857565f23e258e1fcb18590e0ac526e9b380fce88c65a0223b9fefd3d
SSDEEP

393216:wvQ37gGFSrT4XvbmLeLAOqNs2WxsDneQ4LUo7DGqCcKKn:wvkSrT4XvbyeLAO2LeQ54DzKC

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

C2

192.3.141.148:2020

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000b000000023bcc-6.dat	family_xworm
behavioral2/memory/3236-13-0x0000000000A50000-0x0000000000A68000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Control Panel\International\Geo\Nation	steamtools.exe

Executes dropped EXE 2 IoCs

pid	Process
3236	svchost.exe
1700	Steamtools.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1700	Steamtools.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1700	Steamtools.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3236	svchost.exe
Token: SeDebugPrivilege	564	taskmgr.exe
Token: SeSystemProfilePrivilege	564	taskmgr.exe
Token: SeCreateGlobalPrivilege	564	taskmgr.exe
Token: 33	564	taskmgr.exe
Token: SeIncBasePriorityPrivilege	564	taskmgr.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
1700	Steamtools.exe
1700	Steamtools.exe
1700	Steamtools.exe
1700	Steamtools.exe
1700	Steamtools.exe
1700	Steamtools.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
1700	Steamtools.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
1700	Steamtools.exe
1700	Steamtools.exe
1700	Steamtools.exe
1700	Steamtools.exe
1700	Steamtools.exe
1700	Steamtools.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
564	taskmgr.exe
1700	Steamtools.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1700	Steamtools.exe
1700	Steamtools.exe
1700	Steamtools.exe
1700	Steamtools.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 3236	1376	steamtools.exe	87
PID 1376 wrote to memory of 3236	1376	steamtools.exe	87
PID 1376 wrote to memory of 1700	1376	steamtools.exe	88
PID 1376 wrote to memory of 1700	1376	steamtools.exe	88

C:\Users\Admin\AppData\Local\Temp\steamtools.exe
"C:\Users\Admin\AppData\Local\Temp\steamtools.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3236
- C:\Users\Admin\AppData\Roaming\Steamtools.exe
  "C:\Users\Admin\AppData\Roaming\Steamtools.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1700

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Steamtools.exe

Filesize
16.3MB

MD5
1a475aa5000d3958df447de17e0dc14b

SHA1
8a45a8a2b38a524633a99abc7994aa0ac46c03ce

SHA256
1208c4d240918ab0b4767bc6a5c0cbe83ee7f21408fb0c5ea68769ebea759b3e

SHA512
e86be352a5732d18db772f3fc80a70ebb223d68148057663ed18aab5c2221fe6d1cb48d4f4e22940419e9144aeacdc03ea05739352f86aed7ce967afd7e80911

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
73KB

MD5
1ccc85528e0b841dc8e62959c21a9332

SHA1
6918330496f49047808a22d46b5d5ed077f947ae

SHA256
f94b00acec752399dc0f8abe5ab4eea40b998fe4291f9de8c690806997c76c87

SHA512
c01a0990d463317fba18477e25d714f306b6b8e1a68d633d5ce46716175ccbd854788378d40e66c6924dc8b1cee02117d393394097c8dd720a1852d12c6b1417

Download Submit
memory/564-38-0x000001F2C8BE0000-0x000001F2C8BE1000-memory.dmp

Filesize
4KB

Download
memory/564-37-0x000001F2C8BE0000-0x000001F2C8BE1000-memory.dmp

Filesize
4KB

Download
memory/564-35-0x000001F2C8BE0000-0x000001F2C8BE1000-memory.dmp

Filesize
4KB

Download
memory/564-34-0x000001F2C8BE0000-0x000001F2C8BE1000-memory.dmp

Filesize
4KB

Download
memory/564-36-0x000001F2C8BE0000-0x000001F2C8BE1000-memory.dmp

Filesize
4KB

Download
memory/564-28-0x000001F2C8BE0000-0x000001F2C8BE1000-memory.dmp

Filesize
4KB

Download
memory/564-30-0x000001F2C8BE0000-0x000001F2C8BE1000-memory.dmp

Filesize
4KB

Download
memory/564-29-0x000001F2C8BE0000-0x000001F2C8BE1000-memory.dmp

Filesize
4KB

Download
memory/564-39-0x000001F2C8BE0000-0x000001F2C8BE1000-memory.dmp

Filesize
4KB

Download
memory/564-40-0x000001F2C8BE0000-0x000001F2C8BE1000-memory.dmp

Filesize
4KB

Download
memory/1376-0-0x00007FFA11713000-0x00007FFA11715000-memory.dmp

Filesize
8KB

Download
memory/1376-1-0x0000000000920000-0x000000000199A000-memory.dmp

Filesize
16.5MB

Download
memory/3236-13-0x0000000000A50000-0x0000000000A68000-memory.dmp

Filesize
96KB

Download
memory/3236-27-0x00007FFA11710000-0x00007FFA121D1000-memory.dmp

Filesize
10.8MB

Download
memory/3236-14-0x00007FFA11710000-0x00007FFA121D1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads