xworm | 9912ad07b66689f5617312166302b0f4753a5efeb58d184e79c710df73d555c3

General

Target

XClient.exe
Size

68KB
MD5

ae4e61fd837b0e6d4fb3c35007c9545c
SHA1

bb5cf7286d537d5e999be9c533edcd8645a31b33
SHA256

9912ad07b66689f5617312166302b0f4753a5efeb58d184e79c710df73d555c3
SHA512

95fca0fab62b46e3ba93a02655f667e8c17971f76eb4dc4aeab7d4a9a78be0e1292f3ad03b03a78d665fff3dbee589f4c29ccdde6d883f9a18f9301610785d54
SSDEEP

1536:BwaxRT7GSl/rScPN+bXW+tBHTMr6dbrO8jn0wO:/zSiN+bXdtx3rOqzO

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

improve-gis.gl.at.ply.gg:33898

Attributes

Install_directory
%AppData%
install_file
Explorer.exe

Signatures

Detect Xworm Payload 5 IoCs

resource	yara_rule
behavioral1/memory/2488-1-0x00000000010C0000-0x00000000010D8000-memory.dmp	family_xworm
behavioral1/files/0x000b000000018731-35.dat	family_xworm
behavioral1/memory/1968-37-0x00000000000B0000-0x00000000000C8000-memory.dmp	family_xworm
behavioral1/memory/1560-40-0x00000000000F0000-0x0000000000108000-memory.dmp	family_xworm
behavioral1/memory/2268-42-0x0000000000850000-0x0000000000868000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2280	powershell.exe
2056	powershell.exe
2812	powershell.exe
2844	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explorer.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explorer.lnk	XClient.exe

Executes dropped EXE 3 IoCs

pid	Process
1968	Explorer.exe
1560	Explorer.exe
2268	Explorer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Explorer = "C:\\Users\\Admin\\AppData\\Roaming\\Explorer.exe"	XClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2592	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2280	powershell.exe
2056	powershell.exe
2812	powershell.exe
2844	powershell.exe
2488	XClient.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2488	XClient.exe
Token: SeDebugPrivilege	2280	powershell.exe
Token: SeDebugPrivilege	2056	powershell.exe
Token: SeDebugPrivilege	2812	powershell.exe
Token: SeDebugPrivilege	2844	powershell.exe
Token: SeDebugPrivilege	2488	XClient.exe
Token: SeDebugPrivilege	1968	Explorer.exe
Token: SeDebugPrivilege	1560	Explorer.exe
Token: SeDebugPrivilege	2268	Explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2488	XClient.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2280	2488	XClient.exe	30
PID 2488 wrote to memory of 2280	2488	XClient.exe	30
PID 2488 wrote to memory of 2280	2488	XClient.exe	30
PID 2488 wrote to memory of 2056	2488	XClient.exe	32
PID 2488 wrote to memory of 2056	2488	XClient.exe	32
PID 2488 wrote to memory of 2056	2488	XClient.exe	32
PID 2488 wrote to memory of 2812	2488	XClient.exe	34
PID 2488 wrote to memory of 2812	2488	XClient.exe	34
PID 2488 wrote to memory of 2812	2488	XClient.exe	34
PID 2488 wrote to memory of 2844	2488	XClient.exe	36
PID 2488 wrote to memory of 2844	2488	XClient.exe	36
PID 2488 wrote to memory of 2844	2488	XClient.exe	36
PID 2488 wrote to memory of 2592	2488	XClient.exe	39
PID 2488 wrote to memory of 2592	2488	XClient.exe	39
PID 2488 wrote to memory of 2592	2488	XClient.exe	39
PID 2336 wrote to memory of 1968	2336	taskeng.exe	43
PID 2336 wrote to memory of 1968	2336	taskeng.exe	43
PID 2336 wrote to memory of 1968	2336	taskeng.exe	43
PID 2336 wrote to memory of 1560	2336	taskeng.exe	44
PID 2336 wrote to memory of 1560	2336	taskeng.exe	44
PID 2336 wrote to memory of 1560	2336	taskeng.exe	44
PID 2336 wrote to memory of 2268	2336	taskeng.exe	45
PID 2336 wrote to memory of 2268	2336	taskeng.exe	45
PID 2336 wrote to memory of 2268	2336	taskeng.exe	45

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2844
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Explorer" /tr "C:\Users\Admin\AppData\Roaming\Explorer.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2592

C:\Windows\system32\taskeng.exe
taskeng.exe {68451AE2-7E89-4B11-B958-7062A4F6621E} S-1-5-21-4177215427-74451935-3209572229-1000:JSMURNPT\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Users\Admin\AppData\Roaming\Explorer.exe
  C:\Users\Admin\AppData\Roaming\Explorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1968
- C:\Users\Admin\AppData\Roaming\Explorer.exe
  C:\Users\Admin\AppData\Roaming\Explorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1560
- C:\Users\Admin\AppData\Roaming\Explorer.exe
  C:\Users\Admin\AppData\Roaming\Explorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Explorer.exe

Filesize
68KB

MD5
ae4e61fd837b0e6d4fb3c35007c9545c

SHA1
bb5cf7286d537d5e999be9c533edcd8645a31b33

SHA256
9912ad07b66689f5617312166302b0f4753a5efeb58d184e79c710df73d555c3

SHA512
95fca0fab62b46e3ba93a02655f667e8c17971f76eb4dc4aeab7d4a9a78be0e1292f3ad03b03a78d665fff3dbee589f4c29ccdde6d883f9a18f9301610785d54

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
0c72c6dedc94b1fb236ad0daf5a758ba

SHA1
0ea909a2797cff8341a7184aadb84ce72545c45f

SHA256
e7c1261228fcd9bd80936cc66338699d079fe72a005337cb812d78a98e92d923

SHA512
7c322c36286b6875c67c8a063169703492dceee6fcdadd050d9a2abfd2cd823fe414669bbe4885b50ea48b3b72f71fb82052502fae15cba8ea3909ef983aaea7

Download Submit
memory/1560-40-0x00000000000F0000-0x0000000000108000-memory.dmp

Filesize
96KB

Download
memory/1968-37-0x00000000000B0000-0x00000000000C8000-memory.dmp

Filesize
96KB

Download
memory/2056-15-0x0000000002280000-0x0000000002288000-memory.dmp

Filesize
32KB

Download
memory/2056-14-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

Filesize
2.9MB

Download
memory/2268-42-0x0000000000850000-0x0000000000868000-memory.dmp

Filesize
96KB

Download
memory/2280-8-0x0000000002070000-0x0000000002078000-memory.dmp

Filesize
32KB

Download
memory/2280-6-0x0000000002CB0000-0x0000000002D30000-memory.dmp

Filesize
512KB

Download
memory/2280-7-0x000000001B750000-0x000000001BA32000-memory.dmp

Filesize
2.9MB

Download
memory/2488-31-0x000000001B070000-0x000000001B0F0000-memory.dmp

Filesize
512KB

Download
memory/2488-1-0x00000000010C0000-0x00000000010D8000-memory.dmp

Filesize
96KB

Download
memory/2488-33-0x000000001B070000-0x000000001B0F0000-memory.dmp

Filesize
512KB

Download
memory/2488-32-0x000007FEF5B63000-0x000007FEF5B64000-memory.dmp

Filesize
4KB

Download
memory/2488-0-0x000007FEF5B63000-0x000007FEF5B64000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads