xworm | 7f1beb32d0565e8ebe9db45b1bc9a29b8fe6f2cfb7f17605bd2f6ec40f761b89

Analysis

max time kernel
146s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b70645dfb8e566d22c36db3f361bbd320dbaca42930d0d9328e350adc9cef94.exe
Size

123KB
MD5

799a0eb13e004a4717f0a2c81f4ef2a2
SHA1

ab21696be7b802cee1911600d382a17db9f2b8a6
SHA256

5b70645dfb8e566d22c36db3f361bbd320dbaca42930d0d9328e350adc9cef94
SHA512

1c1660778426b66abaf5e7a9486e7799148b52f2e4c1027b892997c2e4ca58cfe66c8af4e0e5251090c8805889ed659f59a31a22dfe57c34ee9807e34f8ec803
SSDEEP

3072:anGuRAAapU2cNd7dTzFAUc/g5wm8XKxmxxWhU6I:anGqGp3cRzFPc4JaKkxxg

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

127.0.0.1:7000

Attributes

install_file
USB.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral18/files/0x000c00000002333a-6.dat	family_xworm
behavioral18/memory/5244-22-0x0000000000790000-0x00000000007A2000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\International\Geo\Nation	5b70645dfb8e566d22c36db3f361bbd320dbaca42930d0d9328e350adc9cef94.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\International\Geo\Nation	Output.exe

Executes dropped EXE 3 IoCs

pid	Process
5244	XClient.exe
556	Output.exe
732	XClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5244	XClient.exe
Token: SeDebugPrivilege	732	XClient.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5564 wrote to memory of 5244	5564	5b70645dfb8e566d22c36db3f361bbd320dbaca42930d0d9328e350adc9cef94.exe	86
PID 5564 wrote to memory of 5244	5564	5b70645dfb8e566d22c36db3f361bbd320dbaca42930d0d9328e350adc9cef94.exe	86
PID 5564 wrote to memory of 556	5564	5b70645dfb8e566d22c36db3f361bbd320dbaca42930d0d9328e350adc9cef94.exe	87
PID 5564 wrote to memory of 556	5564	5b70645dfb8e566d22c36db3f361bbd320dbaca42930d0d9328e350adc9cef94.exe	87
PID 556 wrote to memory of 732	556	Output.exe	88
PID 556 wrote to memory of 732	556	Output.exe	88

C:\Users\Admin\AppData\Local\Temp\5b70645dfb8e566d22c36db3f361bbd320dbaca42930d0d9328e350adc9cef94.exe
"C:\Users\Admin\AppData\Local\Temp\5b70645dfb8e566d22c36db3f361bbd320dbaca42930d0d9328e350adc9cef94.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5564
- C:\Users\Admin\AppData\Roaming\XClient.exe
  "C:\Users\Admin\AppData\Roaming\XClient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5244
- C:\Users\Admin\AppData\Roaming\Output.exe
  "C:\Users\Admin\AppData\Roaming\Output.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:556
- - C:\Users\Admin\AppData\Roaming\XClient.exe
    "C:\Users\Admin\AppData\Roaming\XClient.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Output.exe

Filesize
60KB

MD5
7d89bf804c092b9f318ddb39103df719

SHA1
d4871722c8997afe34f05e71cfc6bec98f8983f5

SHA256
16c7bf7515f7909d69f82de5d05d7e78385a2ee738e971c103ef2150b31e14c4

SHA512
09b6d0e0962eaf3eccca7f883541d7d79b8c138709c7555abc3ca4fad94fc778623a89e592627d0e4a71102dab8eda00b7746dd17d39b5ede1e5eee90c11c26e

Download Submit
C:\Users\Admin\AppData\Roaming\XClient.exe

Filesize
50KB

MD5
e0918682feb10b28a39a9cfbf4d2d90c

SHA1
c33f8518747e96955387bac3c8299eea24357fe0

SHA256
8f7a69675281f0e5f2fd0b43c64434fdb132fdca1eb82cf23aa947f83c833d01

SHA512
dcb3961832197bf33b4e554a69b95a17c847fccde7211ca96ee0a9ad975a051f93e6f29a3a9525279b2aaf9d6b7208a8ddeb8c1d430e79ddf4155f5629038fa7

Download Submit
memory/556-26-0x0000000000FF0000-0x0000000001006000-memory.dmp

Filesize
88KB

Download
memory/556-30-0x00007FFE1B6B0000-0x00007FFE1C171000-memory.dmp

Filesize
10.8MB

Download
memory/556-34-0x00007FFE1B6B0000-0x00007FFE1C171000-memory.dmp

Filesize
10.8MB

Download
memory/5244-22-0x0000000000790000-0x00000000007A2000-memory.dmp

Filesize
72KB

Download
memory/5244-27-0x00007FFE1B6B0000-0x00007FFE1C171000-memory.dmp

Filesize
10.8MB

Download
memory/5244-31-0x00007FFE1B6B0000-0x00007FFE1C171000-memory.dmp

Filesize
10.8MB

Download
memory/5244-33-0x00007FFE1B6B0000-0x00007FFE1C171000-memory.dmp

Filesize
10.8MB

Download
memory/5244-35-0x00007FFE1B6B0000-0x00007FFE1C171000-memory.dmp

Filesize
10.8MB

Download
memory/5564-0-0x00007FFE1B6B3000-0x00007FFE1B6B5000-memory.dmp

Filesize
8KB

Download
memory/5564-1-0x0000000000D30000-0x0000000000D56000-memory.dmp

Filesize
152KB

Download