xworm | a23fdeddb683f716be744ef3fe9a8ce2c87b02f5e5c1f6c8bdb70881de528304

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cef4f0409df2a015e20411fdf8317582dc6ed5f56993dd0122b8006cd695c1db.exe
Size

707KB
MD5

96c50f871ceb7ee1a0b41dcca8da5c01
SHA1

d8946f0af6156c6f69895a2808734d2696660ada
SHA256

cef4f0409df2a015e20411fdf8317582dc6ed5f56993dd0122b8006cd695c1db
SHA512

0ac872561e55a4c2cea0cd6aab965637b4ee6945552aee0a9b1e28ba338d065f98e782e433f7e3ccd464f18bc2ba14307b453ab2b3de8172a7f186018008802e
SSDEEP

12288:9Yxg7plFfjTt/iCiUjM2CiRxNvRJdo/G20F2ilcVeaeW52VJ9GkwPhc:9YKp/jR6Cix2PnNRY+20F2jVEwkw5c

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

127.0.0.1:7000

Attributes

install_file
USB.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral15/files/0x000d00000001202b-5.dat	family_xworm
behavioral15/memory/2620-8-0x0000000000360000-0x0000000000372000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Executes dropped EXE 26 IoCs

pid	Process
2620	XClient.exe
2500	Output.exe
2096	XClient.exe
2908	Output.exe
2804	XClient.exe
2948	Output.exe
2708	XClient.exe
1780	Output.exe
2692	XClient.exe
2744	Output.exe
2196	XClient.exe
1792	Output.exe
2112	XClient.exe
3036	Output.exe
2668	XClient.exe
2900	Output.exe
2008	XClient.exe
2884	Output.exe
1532	Output.exe
1564	XClient.exe
772	XClient.exe
264	Output.exe
1080	XClient.exe
2300	Output.exe
112	XClient.exe
692	Output.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	2620	XClient.exe
Token: SeDebugPrivilege	2096	XClient.exe
Token: SeDebugPrivilege	2804	XClient.exe
Token: SeDebugPrivilege	2708	XClient.exe
Token: SeDebugPrivilege	2692	XClient.exe
Token: SeDebugPrivilege	2196	XClient.exe
Token: SeDebugPrivilege	2112	XClient.exe
Token: SeDebugPrivilege	2668	XClient.exe
Token: SeDebugPrivilege	2008	XClient.exe
Token: SeDebugPrivilege	1564	XClient.exe
Token: SeDebugPrivilege	772	XClient.exe
Token: SeDebugPrivilege	1080	XClient.exe
Token: SeDebugPrivilege	112	XClient.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2620	2628	cef4f0409df2a015e20411fdf8317582dc6ed5f56993dd0122b8006cd695c1db.exe	30
PID 2628 wrote to memory of 2620	2628	cef4f0409df2a015e20411fdf8317582dc6ed5f56993dd0122b8006cd695c1db.exe	30
PID 2628 wrote to memory of 2620	2628	cef4f0409df2a015e20411fdf8317582dc6ed5f56993dd0122b8006cd695c1db.exe	30
PID 2628 wrote to memory of 2500	2628	cef4f0409df2a015e20411fdf8317582dc6ed5f56993dd0122b8006cd695c1db.exe	31
PID 2628 wrote to memory of 2500	2628	cef4f0409df2a015e20411fdf8317582dc6ed5f56993dd0122b8006cd695c1db.exe	31
PID 2628 wrote to memory of 2500	2628	cef4f0409df2a015e20411fdf8317582dc6ed5f56993dd0122b8006cd695c1db.exe	31
PID 2500 wrote to memory of 2096	2500	Output.exe	32
PID 2500 wrote to memory of 2096	2500	Output.exe	32
PID 2500 wrote to memory of 2096	2500	Output.exe	32
PID 2500 wrote to memory of 2908	2500	Output.exe	33
PID 2500 wrote to memory of 2908	2500	Output.exe	33
PID 2500 wrote to memory of 2908	2500	Output.exe	33
PID 2908 wrote to memory of 2804	2908	Output.exe	34
PID 2908 wrote to memory of 2804	2908	Output.exe	34
PID 2908 wrote to memory of 2804	2908	Output.exe	34
PID 2908 wrote to memory of 2948	2908	Output.exe	35
PID 2908 wrote to memory of 2948	2908	Output.exe	35
PID 2908 wrote to memory of 2948	2908	Output.exe	35
PID 2948 wrote to memory of 2708	2948	Output.exe	36
PID 2948 wrote to memory of 2708	2948	Output.exe	36
PID 2948 wrote to memory of 2708	2948	Output.exe	36
PID 2948 wrote to memory of 1780	2948	Output.exe	37
PID 2948 wrote to memory of 1780	2948	Output.exe	37
PID 2948 wrote to memory of 1780	2948	Output.exe	37
PID 1780 wrote to memory of 2692	1780	Output.exe	38
PID 1780 wrote to memory of 2692	1780	Output.exe	38
PID 1780 wrote to memory of 2692	1780	Output.exe	38
PID 1780 wrote to memory of 2744	1780	Output.exe	39
PID 1780 wrote to memory of 2744	1780	Output.exe	39
PID 1780 wrote to memory of 2744	1780	Output.exe	39
PID 2744 wrote to memory of 2196	2744	Output.exe	40
PID 2744 wrote to memory of 2196	2744	Output.exe	40
PID 2744 wrote to memory of 2196	2744	Output.exe	40
PID 2744 wrote to memory of 1792	2744	Output.exe	41
PID 2744 wrote to memory of 1792	2744	Output.exe	41
PID 2744 wrote to memory of 1792	2744	Output.exe	41
PID 1792 wrote to memory of 2112	1792	Output.exe	42
PID 1792 wrote to memory of 2112	1792	Output.exe	42
PID 1792 wrote to memory of 2112	1792	Output.exe	42
PID 1792 wrote to memory of 3036	1792	Output.exe	43
PID 1792 wrote to memory of 3036	1792	Output.exe	43
PID 1792 wrote to memory of 3036	1792	Output.exe	43
PID 3036 wrote to memory of 2668	3036	Output.exe	44
PID 3036 wrote to memory of 2668	3036	Output.exe	44
PID 3036 wrote to memory of 2668	3036	Output.exe	44
PID 3036 wrote to memory of 2900	3036	Output.exe	45
PID 3036 wrote to memory of 2900	3036	Output.exe	45
PID 3036 wrote to memory of 2900	3036	Output.exe	45
PID 2900 wrote to memory of 2008	2900	Output.exe	46
PID 2900 wrote to memory of 2008	2900	Output.exe	46
PID 2900 wrote to memory of 2008	2900	Output.exe	46
PID 2900 wrote to memory of 2884	2900	Output.exe	47
PID 2900 wrote to memory of 2884	2900	Output.exe	47
PID 2900 wrote to memory of 2884	2900	Output.exe	47
PID 2884 wrote to memory of 1564	2884	Output.exe	48
PID 2884 wrote to memory of 1564	2884	Output.exe	48
PID 2884 wrote to memory of 1564	2884	Output.exe	48
PID 2884 wrote to memory of 1532	2884	Output.exe	49
PID 2884 wrote to memory of 1532	2884	Output.exe	49
PID 2884 wrote to memory of 1532	2884	Output.exe	49
PID 1532 wrote to memory of 772	1532	Output.exe	50
PID 1532 wrote to memory of 772	1532	Output.exe	50
PID 1532 wrote to memory of 772	1532	Output.exe	50
PID 1532 wrote to memory of 264	1532	Output.exe	51

C:\Users\Admin\AppData\Local\Temp\cef4f0409df2a015e20411fdf8317582dc6ed5f56993dd0122b8006cd695c1db.exe
"C:\Users\Admin\AppData\Local\Temp\cef4f0409df2a015e20411fdf8317582dc6ed5f56993dd0122b8006cd695c1db.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Users\Admin\AppData\Roaming\XClient.exe
  "C:\Users\Admin\AppData\Roaming\XClient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2620
- C:\Users\Admin\AppData\Roaming\Output.exe
  "C:\Users\Admin\AppData\Roaming\Output.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Users\Admin\AppData\Roaming\XClient.exe
    "C:\Users\Admin\AppData\Roaming\XClient.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2096
- - C:\Users\Admin\AppData\Roaming\Output.exe
    "C:\Users\Admin\AppData\Roaming\Output.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - C:\Users\Admin\AppData\Roaming\XClient.exe
      "C:\Users\Admin\AppData\Roaming\XClient.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2804
  - - C:\Users\Admin\AppData\Roaming\Output.exe
      "C:\Users\Admin\AppData\Roaming\Output.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2948
    - - C:\Users\Admin\AppData\Roaming\XClient.exe
        
        "C:\Users\Admin\AppData\Roaming\XClient.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2708
    - - C:\Users\Admin\AppData\Roaming\Output.exe
        
        "C:\Users\Admin\AppData\Roaming\Output.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1780
      - C:\Users\Admin\AppData\Roaming\XClient.exe
        
        "C:\Users\Admin\AppData\Roaming\XClient.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2692
      - C:\Users\Admin\AppData\Roaming\Output.exe
        
        "C:\Users\Admin\AppData\Roaming\Output.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2744
        
        C:\Users\Admin\AppData\Roaming\XClient.exe
        
        "C:\Users\Admin\AppData\Roaming\XClient.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2196
        
        C:\Users\Admin\AppData\Roaming\Output.exe
        
        "C:\Users\Admin\AppData\Roaming\Output.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Users\Admin\AppData\Roaming\XClient.exe
        
        "C:\Users\Admin\AppData\Roaming\XClient.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2112
        
        C:\Users\Admin\AppData\Roaming\Output.exe
        
        "C:\Users\Admin\AppData\Roaming\Output.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3036
        
        C:\Users\Admin\AppData\Roaming\XClient.exe
        
        "C:\Users\Admin\AppData\Roaming\XClient.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2668
        
        C:\Users\Admin\AppData\Roaming\Output.exe
        
        "C:\Users\Admin\AppData\Roaming\Output.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2900
        
        C:\Users\Admin\AppData\Roaming\XClient.exe
        
        "C:\Users\Admin\AppData\Roaming\XClient.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2008
        
        C:\Users\Admin\AppData\Roaming\Output.exe
        
        "C:\Users\Admin\AppData\Roaming\Output.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2884
        
        C:\Users\Admin\AppData\Roaming\XClient.exe
        
        "C:\Users\Admin\AppData\Roaming\XClient.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1564
        
        C:\Users\Admin\AppData\Roaming\Output.exe
        
        "C:\Users\Admin\AppData\Roaming\Output.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1532
        
        C:\Users\Admin\AppData\Roaming\XClient.exe
        
        "C:\Users\Admin\AppData\Roaming\XClient.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:772
        
        C:\Users\Admin\AppData\Roaming\Output.exe
        
        "C:\Users\Admin\AppData\Roaming\Output.exe"
        12⤵
        Executes dropped EXE
        
        PID:264
        
        C:\Users\Admin\AppData\Roaming\XClient.exe
        
        "C:\Users\Admin\AppData\Roaming\XClient.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1080
        
        C:\Users\Admin\AppData\Roaming\Output.exe
        
        "C:\Users\Admin\AppData\Roaming\Output.exe"
        13⤵
        Executes dropped EXE
        
        PID:2300
        
        C:\Users\Admin\AppData\Roaming\XClient.exe
        
        "C:\Users\Admin\AppData\Roaming\XClient.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:112
        
        C:\Users\Admin\AppData\Roaming\Output.exe
        
        "C:\Users\Admin\AppData\Roaming\Output.exe"
        14⤵
        Executes dropped EXE
        
        PID:692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Output.exe

Filesize
641KB

MD5
be28798fb13ebd61d94d6712436dc399

SHA1
186c13dd590594a63e81b24205d1520a2e03b2cc

SHA256
45be306e0f454b946091c3c0742655878a7eb69a1c7675c9a677438f4e684c34

SHA512
473273021ba324077ae022c8bb10e457d78ce1bfeef95045287915fd15bf1e23cf5a2db42d67c4bb93aba4babb9a8cc71e906ed305f6ad223cf5d1e4534b86a1

Download Submit
C:\Users\Admin\AppData\Roaming\XClient.exe

Filesize
50KB

MD5
e0918682feb10b28a39a9cfbf4d2d90c

SHA1
c33f8518747e96955387bac3c8299eea24357fe0

SHA256
8f7a69675281f0e5f2fd0b43c64434fdb132fdca1eb82cf23aa947f83c833d01

SHA512
dcb3961832197bf33b4e554a69b95a17c847fccde7211ca96ee0a9ad975a051f93e6f29a3a9525279b2aaf9d6b7208a8ddeb8c1d430e79ddf4155f5629038fa7

Download Submit
memory/2500-13-0x0000000001280000-0x0000000001326000-memory.dmp

Filesize
664KB

Download
memory/2620-8-0x0000000000360000-0x0000000000372000-memory.dmp

Filesize
72KB

Download
memory/2620-34-0x000007FEF53B0000-0x000007FEF5D9C000-memory.dmp

Filesize
9.9MB

Download
memory/2620-39-0x000007FEF53B0000-0x000007FEF5D9C000-memory.dmp

Filesize
9.9MB

Download
memory/2620-40-0x000007FEF53B0000-0x000007FEF5D9C000-memory.dmp

Filesize
9.9MB

Download
memory/2628-0-0x000007FEF53B3000-0x000007FEF53B4000-memory.dmp

Filesize
4KB

Download
memory/2628-1-0x0000000000A60000-0x0000000000B18000-memory.dmp

Filesize
736KB

Download