xworm | 5656064ae4d3c302be4f376131bce57fa83ba30e94c329f33adb91836d7f4bf8

Analysis

max time kernel
147s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe
Size

446KB
MD5

68e298b36db386382e7dfbe5bd784699
SHA1

123700bc8004ee6c9967a6818689658c23cf4996
SHA256

342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875
SHA512

879f41008ddd3464026b5c93338246fddfcc640e2790bf3d106555e22103dde1bfc33e23125e891a676daa263635518142cbf481f91b0671adfadce63222a562
SSDEEP

12288:CEgwe8+6XzGT4DaHK8mzQz9vIQozyiScxvN4HZwujQ:C1wjDaq5zOgRzyQvNKh

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

127.0.0.1:7000

Attributes

install_file
USB.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral13/files/0x0007000000012117-5.dat	family_xworm
behavioral13/memory/2660-12-0x0000000001380000-0x0000000001392000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Executes dropped EXE 30 IoCs

pid	Process
2660	XClient.exe
2564	Output.exe
2584	XClient.exe
2700	Output.exe
2580	Output.exe
2992	XClient.exe
1984	Output.exe
1896	XClient.exe
2888	Output.exe
2616	XClient.exe
2036	Output.exe
1840	XClient.exe
1496	Output.exe
1448	XClient.exe
1996	Output.exe
1492	XClient.exe
620	XClient.exe
2024	Output.exe
1780	Output.exe
2208	XClient.exe
2232	Output.exe
1616	XClient.exe
916	Output.exe
1692	XClient.exe
2100	XClient.exe
736	Output.exe
1696	Output.exe
1784	XClient.exe
884	Output.exe
1968	XClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	2660	XClient.exe
Token: SeDebugPrivilege	2584	XClient.exe
Token: SeDebugPrivilege	1896	XClient.exe
Token: SeDebugPrivilege	2616	XClient.exe
Token: SeDebugPrivilege	2992	XClient.exe
Token: SeDebugPrivilege	1840	XClient.exe
Token: SeDebugPrivilege	1448	XClient.exe
Token: SeDebugPrivilege	1492	XClient.exe
Token: SeDebugPrivilege	620	XClient.exe
Token: SeDebugPrivilege	1616	XClient.exe
Token: SeDebugPrivilege	2208	XClient.exe
Token: SeDebugPrivilege	1692	XClient.exe
Token: SeDebugPrivilege	2100	XClient.exe
Token: SeDebugPrivilege	1784	XClient.exe
Token: SeDebugPrivilege	1968	XClient.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2660	2724	342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe	30
PID 2724 wrote to memory of 2660	2724	342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe	30
PID 2724 wrote to memory of 2660	2724	342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe	30
PID 2724 wrote to memory of 2564	2724	342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe	31
PID 2724 wrote to memory of 2564	2724	342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe	31
PID 2724 wrote to memory of 2564	2724	342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe	31
PID 2564 wrote to memory of 2584	2564	Output.exe	32
PID 2564 wrote to memory of 2584	2564	Output.exe	32
PID 2564 wrote to memory of 2584	2564	Output.exe	32
PID 2564 wrote to memory of 2700	2564	Output.exe	33
PID 2564 wrote to memory of 2700	2564	Output.exe	33
PID 2564 wrote to memory of 2700	2564	Output.exe	33
PID 2700 wrote to memory of 2992	2700	Output.exe	34
PID 2700 wrote to memory of 2992	2700	Output.exe	34
PID 2700 wrote to memory of 2992	2700	Output.exe	34
PID 2700 wrote to memory of 2580	2700	Output.exe	35
PID 2700 wrote to memory of 2580	2700	Output.exe	35
PID 2700 wrote to memory of 2580	2700	Output.exe	35
PID 2580 wrote to memory of 1896	2580	Output.exe	36
PID 2580 wrote to memory of 1896	2580	Output.exe	36
PID 2580 wrote to memory of 1896	2580	Output.exe	36
PID 2580 wrote to memory of 1984	2580	Output.exe	37
PID 2580 wrote to memory of 1984	2580	Output.exe	37
PID 2580 wrote to memory of 1984	2580	Output.exe	37
PID 1984 wrote to memory of 2616	1984	Output.exe	38
PID 1984 wrote to memory of 2616	1984	Output.exe	38
PID 1984 wrote to memory of 2616	1984	Output.exe	38
PID 1984 wrote to memory of 2888	1984	Output.exe	39
PID 1984 wrote to memory of 2888	1984	Output.exe	39
PID 1984 wrote to memory of 2888	1984	Output.exe	39
PID 2888 wrote to memory of 1840	2888	Output.exe	40
PID 2888 wrote to memory of 1840	2888	Output.exe	40
PID 2888 wrote to memory of 1840	2888	Output.exe	40
PID 2888 wrote to memory of 2036	2888	Output.exe	41
PID 2888 wrote to memory of 2036	2888	Output.exe	41
PID 2888 wrote to memory of 2036	2888	Output.exe	41
PID 2036 wrote to memory of 1448	2036	Output.exe	42
PID 2036 wrote to memory of 1448	2036	Output.exe	42
PID 2036 wrote to memory of 1448	2036	Output.exe	42
PID 2036 wrote to memory of 1496	2036	Output.exe	43
PID 2036 wrote to memory of 1496	2036	Output.exe	43
PID 2036 wrote to memory of 1496	2036	Output.exe	43
PID 1496 wrote to memory of 1492	1496	Output.exe	44
PID 1496 wrote to memory of 1492	1496	Output.exe	44
PID 1496 wrote to memory of 1492	1496	Output.exe	44
PID 1496 wrote to memory of 1996	1496	Output.exe	45
PID 1496 wrote to memory of 1996	1496	Output.exe	45
PID 1496 wrote to memory of 1996	1496	Output.exe	45
PID 1996 wrote to memory of 620	1996	Output.exe	46
PID 1996 wrote to memory of 620	1996	Output.exe	46
PID 1996 wrote to memory of 620	1996	Output.exe	46
PID 1996 wrote to memory of 2024	1996	Output.exe	47
PID 1996 wrote to memory of 2024	1996	Output.exe	47
PID 1996 wrote to memory of 2024	1996	Output.exe	47
PID 2024 wrote to memory of 2208	2024	Output.exe	48
PID 2024 wrote to memory of 2208	2024	Output.exe	48
PID 2024 wrote to memory of 2208	2024	Output.exe	48
PID 2024 wrote to memory of 1780	2024	Output.exe	49
PID 2024 wrote to memory of 1780	2024	Output.exe	49
PID 2024 wrote to memory of 1780	2024	Output.exe	49
PID 1780 wrote to memory of 1616	1780	Output.exe	50
PID 1780 wrote to memory of 1616	1780	Output.exe	50
PID 1780 wrote to memory of 1616	1780	Output.exe	50
PID 1780 wrote to memory of 2232	1780	Output.exe	51

C:\Users\Admin\AppData\Local\Temp\342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe
"C:\Users\Admin\AppData\Local\Temp\342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Users\Admin\AppData\Roaming\XClient.exe
  "C:\Users\Admin\AppData\Roaming\XClient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2660
- C:\Users\Admin\AppData\Roaming\Output.exe
  "C:\Users\Admin\AppData\Roaming\Output.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Users\Admin\AppData\Roaming\XClient.exe
    "C:\Users\Admin\AppData\Roaming\XClient.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2584
- - C:\Users\Admin\AppData\Roaming\Output.exe
    "C:\Users\Admin\AppData\Roaming\Output.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2700
  - - C:\Users\Admin\AppData\Roaming\XClient.exe
      "C:\Users\Admin\AppData\Roaming\XClient.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2992
  - - C:\Users\Admin\AppData\Roaming\Output.exe
      "C:\Users\Admin\AppData\Roaming\Output.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2580
    - - C:\Users\Admin\AppData\Roaming\XClient.exe
        
        "C:\Users\Admin\AppData\Roaming\XClient.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1896
    - - C:\Users\Admin\AppData\Roaming\Output.exe
        
        "C:\Users\Admin\AppData\Roaming\Output.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1984
      - C:\Users\Admin\AppData\Roaming\XClient.exe
        
        "C:\Users\Admin\AppData\Roaming\XClient.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2616
      - C:\Users\Admin\AppData\Roaming\Output.exe
        
        "C:\Users\Admin\AppData\Roaming\Output.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2888
        
        C:\Users\Admin\AppData\Roaming\XClient.exe
        
        "C:\Users\Admin\AppData\Roaming\XClient.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1840
        
        C:\Users\Admin\AppData\Roaming\Output.exe
        
        "C:\Users\Admin\AppData\Roaming\Output.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2036
        
        C:\Users\Admin\AppData\Roaming\XClient.exe
        
        "C:\Users\Admin\AppData\Roaming\XClient.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1448
        
        C:\Users\Admin\AppData\Roaming\Output.exe
        
        "C:\Users\Admin\AppData\Roaming\Output.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1496
        
        C:\Users\Admin\AppData\Roaming\XClient.exe
        
        "C:\Users\Admin\AppData\Roaming\XClient.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1492
        
        C:\Users\Admin\AppData\Roaming\Output.exe
        
        "C:\Users\Admin\AppData\Roaming\Output.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1996
        
        C:\Users\Admin\AppData\Roaming\XClient.exe
        
        "C:\Users\Admin\AppData\Roaming\XClient.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:620
        
        C:\Users\Admin\AppData\Roaming\Output.exe
        
        "C:\Users\Admin\AppData\Roaming\Output.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2024
        
        C:\Users\Admin\AppData\Roaming\XClient.exe
        
        "C:\Users\Admin\AppData\Roaming\XClient.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2208
        
        C:\Users\Admin\AppData\Roaming\Output.exe
        
        "C:\Users\Admin\AppData\Roaming\Output.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1780
        
        C:\Users\Admin\AppData\Roaming\XClient.exe
        
        "C:\Users\Admin\AppData\Roaming\XClient.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1616
        
        C:\Users\Admin\AppData\Roaming\Output.exe
        
        "C:\Users\Admin\AppData\Roaming\Output.exe"
        12⤵
        Executes dropped EXE
        
        PID:2232
        
        C:\Users\Admin\AppData\Roaming\XClient.exe
        
        "C:\Users\Admin\AppData\Roaming\XClient.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1692
        
        C:\Users\Admin\AppData\Roaming\Output.exe
        
        "C:\Users\Admin\AppData\Roaming\Output.exe"
        13⤵
        Executes dropped EXE
        
        PID:916
        
        C:\Users\Admin\AppData\Roaming\XClient.exe
        
        "C:\Users\Admin\AppData\Roaming\XClient.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2100
        
        C:\Users\Admin\AppData\Roaming\Output.exe
        
        "C:\Users\Admin\AppData\Roaming\Output.exe"
        14⤵
        Executes dropped EXE
        
        PID:736
        
        C:\Users\Admin\AppData\Roaming\XClient.exe
        
        "C:\Users\Admin\AppData\Roaming\XClient.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1784
        
        C:\Users\Admin\AppData\Roaming\Output.exe
        
        "C:\Users\Admin\AppData\Roaming\Output.exe"
        15⤵
        Executes dropped EXE
        
        PID:1696
        
        C:\Users\Admin\AppData\Roaming\XClient.exe
        
        "C:\Users\Admin\AppData\Roaming\XClient.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1968
        
        C:\Users\Admin\AppData\Roaming\Output.exe
        
        "C:\Users\Admin\AppData\Roaming\Output.exe"
        16⤵
        Executes dropped EXE
        
        PID:884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Output.exe

Filesize
379KB

MD5
07720f4f6cd70f9f90daf6767fe0fc89

SHA1
8f5474705182cbf8a9f87588c03676a491146183

SHA256
cd07d3aec1ce392935b664562266eac8a27260ff8b434a74bf9e8368c997242e

SHA512
fa656008147051a7831f79b341c786865f08220a08f358e218b3de0896f6719f9517a9af44f9f9e48d2f15460ca184fc669ac1e7f9a390b1c7057f1697c74e47

Download Submit
C:\Users\Admin\AppData\Roaming\XClient.exe

Filesize
50KB

MD5
e0918682feb10b28a39a9cfbf4d2d90c

SHA1
c33f8518747e96955387bac3c8299eea24357fe0

SHA256
8f7a69675281f0e5f2fd0b43c64434fdb132fdca1eb82cf23aa947f83c833d01

SHA512
dcb3961832197bf33b4e554a69b95a17c847fccde7211ca96ee0a9ad975a051f93e6f29a3a9525279b2aaf9d6b7208a8ddeb8c1d430e79ddf4155f5629038fa7

Download Submit
memory/2564-13-0x0000000000F90000-0x0000000000FF6000-memory.dmp

Filesize
408KB

Download
memory/2660-12-0x0000000001380000-0x0000000001392000-memory.dmp

Filesize
72KB

Download
memory/2660-42-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

Filesize
9.9MB

Download
memory/2660-43-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

Filesize
9.9MB

Download
memory/2724-0-0x000007FEF5433000-0x000007FEF5434000-memory.dmp

Filesize
4KB

Download
memory/2724-1-0x0000000001270000-0x00000000012E6000-memory.dmp

Filesize
472KB

Download