xworm | 919161265bdda133ab4c6693baa0d603c7713ca71636d262c1d3a5805d28d05d

General

Target

Xeno.exe
Size

3.0MB
MD5

158b3d88e3cebfa581703ee917bad272
SHA1

759c69673d8326e8e73e72297bf0ac4eb1e0a217
SHA256

919161265bdda133ab4c6693baa0d603c7713ca71636d262c1d3a5805d28d05d
SHA512

023af21a4c339559124df0d5cc280dfa63d7824ea7474c92f95cfa04b482bd879ff359b1511f8bd4e35f2344bae84fadb8ff8f784d792575197f1aba9211f189
SSDEEP

49152:ytlcyXfHnaBTof9ePCjkIAm1skqXfd+/9A9ByClY1v/a/ehH7pNLLn2:yfZXfHaFoCIvqkqXf0FglY1XOe97vLn

Score

10^/10

xworm discovery rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

earth-northwest.gl.at.ply.gg:49617

Mutex

jek2DMhZuJKlksdl

Attributes

Install_directory
%AppData%
install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023c90-15.dat	family_xworm
behavioral1/memory/1020-23-0x00000000006F0000-0x0000000000700000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\International\Geo\Nation	Xeno.exe

Executes dropped EXE 2 IoCs

pid	Process
4188	BOOTSTRAPPERNEW.EXE
1020	SOLARA.EXE

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
22	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Xeno.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1020	SOLARA.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 4188	5064	Xeno.exe	91
PID 5064 wrote to memory of 4188	5064	Xeno.exe	91
PID 5064 wrote to memory of 1020	5064	Xeno.exe	92
PID 5064 wrote to memory of 1020	5064	Xeno.exe	92

C:\Users\Admin\AppData\Local\Temp\Xeno.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERNEW.EXE
  "C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERNEW.EXE"
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Users\Admin\AppData\Local\Temp\SOLARA.EXE
  "C:\Users\Admin\AppData\Local\Temp\SOLARA.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BOOTSTRAPPERNEW.EXE

Filesize
2.9MB

MD5
f227cdfd423b3cc03bb69c49babf4da3

SHA1
3db5a97d9b0f2545e7ba97026af6c28512200441

SHA256
cb5d6c1ca0aa6232a2d55e14b20ac4a9945a0bd063c57d60a5ed3ae94160e3e8

SHA512
b10afd03b02a928545c16fad39a6ae46b68b1e1a2477a6990803ce80008e7161fb2ebc9380ba15a1b074bb436aa34bcd6c94a922933d438b1c22489717e1e10e

Download Submit
C:\Users\Admin\AppData\Local\Temp\SOLARA.EXE

Filesize
40KB

MD5
6aaa04f906e1966d6d97b0855ea1fa7f

SHA1
8b08c6ae9f383b8d819e852552c2ea7af707f51e

SHA256
619979ec317a16e0a29953786279c36294f2b78338f152242f6536d458819262

SHA512
0cf695a4b8367f28196e329ccdbec7877cb55cefa548a6388d12977951225f20cc70bf99ce575433cf51c30546e03e765121bd2f8b89bdefa703d7e4e50f6383

Download Submit
memory/1020-41-0x00007FF962C50000-0x00007FF963711000-memory.dmp

Filesize
10.8MB

Download
memory/1020-23-0x00000000006F0000-0x0000000000700000-memory.dmp

Filesize
64KB

Download
memory/1020-40-0x00007FF962C50000-0x00007FF963711000-memory.dmp

Filesize
10.8MB

Download
memory/1020-25-0x00007FF962C50000-0x00007FF963711000-memory.dmp

Filesize
10.8MB

Download
memory/4188-36-0x0000026379CD0000-0x0000026379CDA000-memory.dmp

Filesize
40KB

Download
memory/4188-24-0x0000026373840000-0x0000026373B22000-memory.dmp

Filesize
2.9MB

Download
memory/4188-28-0x0000026379B00000-0x0000026379B08000-memory.dmp

Filesize
32KB

Download
memory/4188-29-0x0000026379CE0000-0x0000026379D18000-memory.dmp

Filesize
224KB

Download
memory/4188-31-0x000002637A3A0000-0x000002637A4A0000-memory.dmp

Filesize
1024KB

Download
memory/4188-30-0x0000026379CA0000-0x0000026379CAE000-memory.dmp

Filesize
56KB

Download
memory/4188-32-0x0000026379CB0000-0x0000026379CBA000-memory.dmp

Filesize
40KB

Download
memory/4188-33-0x0000026379D20000-0x0000026379D46000-memory.dmp

Filesize
152KB

Download
memory/4188-34-0x0000026379D50000-0x0000026379D58000-memory.dmp

Filesize
32KB

Download
memory/4188-35-0x0000026379D60000-0x0000026379D76000-memory.dmp

Filesize
88KB

Download
memory/4188-26-0x00007FF962C50000-0x00007FF963711000-memory.dmp

Filesize
10.8MB

Download
memory/4188-37-0x0000026379CC0000-0x0000026379CCA000-memory.dmp

Filesize
40KB

Download
memory/4188-38-0x0000026379D90000-0x0000026379D98000-memory.dmp

Filesize
32KB

Download
memory/4188-27-0x0000026373F00000-0x0000026373F10000-memory.dmp

Filesize
64KB

Download
memory/4188-20-0x00007FF962C53000-0x00007FF962C55000-memory.dmp

Filesize
8KB

Download
memory/4188-42-0x00007FF962C53000-0x00007FF962C55000-memory.dmp

Filesize
8KB

Download
memory/4188-43-0x00000263760B0000-0x00000263762A7000-memory.dmp

Filesize
2.0MB

Download
memory/4188-44-0x00007FF962C50000-0x00007FF963711000-memory.dmp

Filesize
10.8MB

Download
memory/4188-45-0x00000263760B0000-0x00000263762A7000-memory.dmp

Filesize
2.0MB

Download
memory/4188-46-0x00000263760B0000-0x00000263762A7000-memory.dmp

Filesize
2.0MB

Download
memory/4188-47-0x00000263760B0000-0x00000263762A7000-memory.dmp

Filesize
2.0MB

Download
memory/4188-48-0x00000263760B0000-0x00000263762A7000-memory.dmp

Filesize
2.0MB

Download
memory/4188-49-0x00000263760B0000-0x00000263762A7000-memory.dmp

Filesize
2.0MB

Download
memory/4188-50-0x00000263760B0000-0x00000263762A7000-memory.dmp

Filesize
2.0MB

Download
memory/4188-51-0x00000263760B0000-0x00000263762A7000-memory.dmp

Filesize
2.0MB

Download
memory/4188-52-0x00000263760B0000-0x00000263762A7000-memory.dmp

Filesize
2.0MB

Download
memory/4188-53-0x00000263760B0000-0x00000263762A7000-memory.dmp

Filesize
2.0MB

Download
memory/4188-54-0x00000263760B0000-0x00000263762A7000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing