xworm | 6681cb73deb0effc4f44f704c6bddb07e98c1f8da4c8478cca7ddd49abdb0c3f

Analysis

max time kernel
149s
max time network
125s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b0acebe24bf7a0fa1e25e0e9174184ad9827298b7ff75384049deed6e74c306.exe
Size

316KB
MD5

3712cf0750a5fd9bec05a0b62be6397d
SHA1

1024df56ce919a3695a7a881de4742b9ea06a221
SHA256

1b0acebe24bf7a0fa1e25e0e9174184ad9827298b7ff75384049deed6e74c306
SHA512

416c2c3e16049ff492f48de8d0d6b8b009d9468d90fd2e07250b8c2a9b7dcd746098f834ebe30adfea1f5457271ba9480bd4db3d7882deb235c0579d140e6ee8
SSDEEP

6144:4xURWkZv8/643Toyn6jIvril1nKMn9oW6AL/RN2ozqd9K:4qYkZODoy6je2nKM9oKD2oem

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

127.0.0.1:7000

Attributes

install_file
USB.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral19/files/0x0009000000012117-5.dat	family_xworm
behavioral19/memory/2308-11-0x00000000003A0000-0x00000000003B2000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Executes dropped EXE 8 IoCs

pid	Process
2308	XClient.exe
2304	Output.exe
2220	XClient.exe
2420	Output.exe
2856	XClient.exe
2920	Output.exe
2948	XClient.exe
2716	Output.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2308	XClient.exe
Token: SeDebugPrivilege	2220	XClient.exe
Token: SeDebugPrivilege	2856	XClient.exe
Token: SeDebugPrivilege	2948	XClient.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2308	1672	1b0acebe24bf7a0fa1e25e0e9174184ad9827298b7ff75384049deed6e74c306.exe	30
PID 1672 wrote to memory of 2308	1672	1b0acebe24bf7a0fa1e25e0e9174184ad9827298b7ff75384049deed6e74c306.exe	30
PID 1672 wrote to memory of 2308	1672	1b0acebe24bf7a0fa1e25e0e9174184ad9827298b7ff75384049deed6e74c306.exe	30
PID 1672 wrote to memory of 2304	1672	1b0acebe24bf7a0fa1e25e0e9174184ad9827298b7ff75384049deed6e74c306.exe	31
PID 1672 wrote to memory of 2304	1672	1b0acebe24bf7a0fa1e25e0e9174184ad9827298b7ff75384049deed6e74c306.exe	31
PID 1672 wrote to memory of 2304	1672	1b0acebe24bf7a0fa1e25e0e9174184ad9827298b7ff75384049deed6e74c306.exe	31
PID 2304 wrote to memory of 2220	2304	Output.exe	32
PID 2304 wrote to memory of 2220	2304	Output.exe	32
PID 2304 wrote to memory of 2220	2304	Output.exe	32
PID 2304 wrote to memory of 2420	2304	Output.exe	33
PID 2304 wrote to memory of 2420	2304	Output.exe	33
PID 2304 wrote to memory of 2420	2304	Output.exe	33
PID 2420 wrote to memory of 2856	2420	Output.exe	34
PID 2420 wrote to memory of 2856	2420	Output.exe	34
PID 2420 wrote to memory of 2856	2420	Output.exe	34
PID 2420 wrote to memory of 2920	2420	Output.exe	35
PID 2420 wrote to memory of 2920	2420	Output.exe	35
PID 2420 wrote to memory of 2920	2420	Output.exe	35
PID 2920 wrote to memory of 2948	2920	Output.exe	36
PID 2920 wrote to memory of 2948	2920	Output.exe	36
PID 2920 wrote to memory of 2948	2920	Output.exe	36
PID 2920 wrote to memory of 2716	2920	Output.exe	37
PID 2920 wrote to memory of 2716	2920	Output.exe	37
PID 2920 wrote to memory of 2716	2920	Output.exe	37

C:\Users\Admin\AppData\Local\Temp\1b0acebe24bf7a0fa1e25e0e9174184ad9827298b7ff75384049deed6e74c306.exe
"C:\Users\Admin\AppData\Local\Temp\1b0acebe24bf7a0fa1e25e0e9174184ad9827298b7ff75384049deed6e74c306.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Users\Admin\AppData\Roaming\XClient.exe
  "C:\Users\Admin\AppData\Roaming\XClient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2308
- C:\Users\Admin\AppData\Roaming\Output.exe
  "C:\Users\Admin\AppData\Roaming\Output.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Users\Admin\AppData\Roaming\XClient.exe
    "C:\Users\Admin\AppData\Roaming\XClient.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2220
- - C:\Users\Admin\AppData\Roaming\Output.exe
    "C:\Users\Admin\AppData\Roaming\Output.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2420
  - - C:\Users\Admin\AppData\Roaming\XClient.exe
      "C:\Users\Admin\AppData\Roaming\XClient.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2856
  - - C:\Users\Admin\AppData\Roaming\Output.exe
      "C:\Users\Admin\AppData\Roaming\Output.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2920
    - - C:\Users\Admin\AppData\Roaming\XClient.exe
        
        "C:\Users\Admin\AppData\Roaming\XClient.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2948
    - - C:\Users\Admin\AppData\Roaming\Output.exe
        
        "C:\Users\Admin\AppData\Roaming\Output.exe"
        5⤵
        Executes dropped EXE
        
        PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Output.exe

Filesize
251KB

MD5
3ac2fbaa37549eb0c50eedbca0da41c2

SHA1
a486d241a02989d2adbff9785c7c39e68a2934af

SHA256
815021055de7349aafb51c6788bfd8f1a0f9fc242e842d6b8bf639283a4658fd

SHA512
76ac7165eba850a34e9dd459c538e1e0ceaee09896e711dabc1272c76a0a79b0826124cec4c43d626b390c222367af55b3de452312e51725f994d218cbe0e7f7

Download Submit
C:\Users\Admin\AppData\Roaming\XClient.exe

Filesize
50KB

MD5
e0918682feb10b28a39a9cfbf4d2d90c

SHA1
c33f8518747e96955387bac3c8299eea24357fe0

SHA256
8f7a69675281f0e5f2fd0b43c64434fdb132fdca1eb82cf23aa947f83c833d01

SHA512
dcb3961832197bf33b4e554a69b95a17c847fccde7211ca96ee0a9ad975a051f93e6f29a3a9525279b2aaf9d6b7208a8ddeb8c1d430e79ddf4155f5629038fa7

Download Submit
memory/1672-0-0x000007FEF5FD3000-0x000007FEF5FD4000-memory.dmp

Filesize
4KB

Download
memory/1672-1-0x0000000001000000-0x0000000001056000-memory.dmp

Filesize
344KB

Download
memory/2304-13-0x0000000000280000-0x00000000002C6000-memory.dmp

Filesize
280KB

Download
memory/2308-11-0x00000000003A0000-0x00000000003B2000-memory.dmp

Filesize
72KB

Download
memory/2308-17-0x000007FEF5FD0000-0x000007FEF69BC000-memory.dmp

Filesize
9.9MB

Download
memory/2308-21-0x000007FEF5FD0000-0x000007FEF69BC000-memory.dmp

Filesize
9.9MB

Download
memory/2308-22-0x000007FEF5FD0000-0x000007FEF69BC000-memory.dmp

Filesize
9.9MB

Download