xworm | 7f1beb32d0565e8ebe9db45b1bc9a29b8fe6f2cfb7f17605bd2f6ec40f761b89

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c55fbcb2e826d47b9446973666e9dfbb429c5e37581d6641b0cf2528649ef2a.exe
Size

495KB
MD5

4f0cb3352c75a47e9fb8cc3a08fe62fc
SHA1

7f992fe7e02920b6e81a8375e7783d3ff3ec8594
SHA256

5c55fbcb2e826d47b9446973666e9dfbb429c5e37581d6641b0cf2528649ef2a
SHA512

7ba555345f6acfb3bd9351f96d56891e7529f393d03ea557c0ed796ece46ca2103e082d648b9b472168ba37abcacf18bab98c1facc6b4e80be06f8ca6ab5bd39
SSDEEP

6144:SrUyLo6Ne40BlxE4F459KSLUKF2U6B/Z3InJv6jsyZIf78p33MYn65lMDKEmcSpM:SQb6Ne405E4aqYU1SUZO8pnMXADdSl

Score

10^/10

xworm discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

or-city.gl.at.ply.gg:62747

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral31/memory/560-9-0x0000000000F50000-0x0000000000F66000-memory.dmp	family_xworm
behavioral31/files/0x000c00000001227e-6.dat	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2832	powershell.exe
2560	powershell.exe
2928	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
560	WizClient211ё.exe
2264	!Automatic error fixer by lowcode.exe
2768	WizClient211ё.exe
1952	WizClient211ё.exe
2352	WizClient211ё.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\WizClient211ё = "C:\\Users\\Admin\\AppData\\Roaming\\WizClient211ё.exe"	WizClient211ё.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2264	!Automatic error fixer by lowcode.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!Automatic error fixer by lowcode.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	WizClient211ё.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	WizClient211ё.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1932	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2832	powershell.exe
2928	powershell.exe
2560	powershell.exe
560	WizClient211ё.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	560	WizClient211ё.exe
Token: SeDebugPrivilege	2832	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeDebugPrivilege	560	WizClient211ё.exe
Token: SeDebugPrivilege	2768	WizClient211ё.exe
Token: SeDebugPrivilege	1952	WizClient211ё.exe
Token: SeDebugPrivilege	2352	WizClient211ё.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
560	WizClient211ё.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 560	1484	5c55fbcb2e826d47b9446973666e9dfbb429c5e37581d6641b0cf2528649ef2a.exe	31
PID 1484 wrote to memory of 560	1484	5c55fbcb2e826d47b9446973666e9dfbb429c5e37581d6641b0cf2528649ef2a.exe	31
PID 1484 wrote to memory of 560	1484	5c55fbcb2e826d47b9446973666e9dfbb429c5e37581d6641b0cf2528649ef2a.exe	31
PID 1484 wrote to memory of 2264	1484	5c55fbcb2e826d47b9446973666e9dfbb429c5e37581d6641b0cf2528649ef2a.exe	32
PID 1484 wrote to memory of 2264	1484	5c55fbcb2e826d47b9446973666e9dfbb429c5e37581d6641b0cf2528649ef2a.exe	32
PID 1484 wrote to memory of 2264	1484	5c55fbcb2e826d47b9446973666e9dfbb429c5e37581d6641b0cf2528649ef2a.exe	32
PID 1484 wrote to memory of 2264	1484	5c55fbcb2e826d47b9446973666e9dfbb429c5e37581d6641b0cf2528649ef2a.exe	32
PID 560 wrote to memory of 2832	560	WizClient211ё.exe	34
PID 560 wrote to memory of 2832	560	WizClient211ё.exe	34
PID 560 wrote to memory of 2832	560	WizClient211ё.exe	34
PID 560 wrote to memory of 2928	560	WizClient211ё.exe	36
PID 560 wrote to memory of 2928	560	WizClient211ё.exe	36
PID 560 wrote to memory of 2928	560	WizClient211ё.exe	36
PID 560 wrote to memory of 2560	560	WizClient211ё.exe	38
PID 560 wrote to memory of 2560	560	WizClient211ё.exe	38
PID 560 wrote to memory of 2560	560	WizClient211ё.exe	38
PID 560 wrote to memory of 1932	560	WizClient211ё.exe	40
PID 560 wrote to memory of 1932	560	WizClient211ё.exe	40
PID 560 wrote to memory of 1932	560	WizClient211ё.exe	40
PID 1032 wrote to memory of 2768	1032	taskeng.exe	43
PID 1032 wrote to memory of 2768	1032	taskeng.exe	43
PID 1032 wrote to memory of 2768	1032	taskeng.exe	43
PID 1032 wrote to memory of 1952	1032	taskeng.exe	45
PID 1032 wrote to memory of 1952	1032	taskeng.exe	45
PID 1032 wrote to memory of 1952	1032	taskeng.exe	45
PID 1032 wrote to memory of 2352	1032	taskeng.exe	46
PID 1032 wrote to memory of 2352	1032	taskeng.exe	46
PID 1032 wrote to memory of 2352	1032	taskeng.exe	46

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\5c55fbcb2e826d47b9446973666e9dfbb429c5e37581d6641b0cf2528649ef2a.exe
"C:\Users\Admin\AppData\Local\Temp\5c55fbcb2e826d47b9446973666e9dfbb429c5e37581d6641b0cf2528649ef2a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Users\Admin\AppData\Roaming\WizClient211ё.exe
  "C:\Users\Admin\AppData\Roaming\WizClient211ё.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WizClient211ё.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WizClient211ё.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WizClient211ё.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2560
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WizClient211ё" /tr "C:\Users\Admin\AppData\Roaming\WizClient211ё.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1932
- C:\Users\Admin\AppData\Roaming\!Automatic error fixer by lowcode.exe
  "C:\Users\Admin\AppData\Roaming\!Automatic error fixer by lowcode.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:2264

C:\Windows\system32\taskeng.exe
taskeng.exe {DDE231DC-7838-463C-A9A4-03D571D689B0} S-1-5-21-2872745919-2748461613-2989606286-1000:CCJBVTGQ\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Users\Admin\AppData\Roaming\WizClient211ё.exe
  C:\Users\Admin\AppData\Roaming\WizClient211ё.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2768
- C:\Users\Admin\AppData\Roaming\WizClient211ё.exe
  C:\Users\Admin\AppData\Roaming\WizClient211ё.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1952
- C:\Users\Admin\AppData\Roaming\WizClient211ё.exe
  C:\Users\Admin\AppData\Roaming\WizClient211ё.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\!Automatic error fixer by lowcode.exe

Filesize
421KB

MD5
7872ea21c0bb3f03911e7029a5735a6c

SHA1
bf05a9de2aff6b19eeef389d0eccd10ee49f96b8

SHA256
f614a98a634cdd99bf0945c65ce041f891da4fb4f0aeee6e59397347793ab8a7

SHA512
e5765d47e2010eab477ec3743b3ee8093d9cc6295f2abf6470d81cee83ba50e566b2ae5cfb34238d375e9536a88060f2f7a76f3ee9f68c21e6517da90097209d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9RXMBFK6AFI86F6MOM98.temp

Filesize
7KB

MD5
0785880765e0ce3aa48773e4340941ef

SHA1
30e753ada73a3e5c4b1972588f6f716e3a6b3dda

SHA256
de87345da323cee87dfd07db904153d1fd7d33d0d1ba7352d0e6edecf5a6d599

SHA512
93c5b5d2d63d10c66f9b627954b07b44c7709bc63e0a5aa4ab5ced9e998e4b90de6195cfebf3207923906c4df751a988811cd9a5767ac8d45266e1d949f26bba

Download Submit
C:\Users\Admin\AppData\Roaming\WizClient211ё.exe

Filesize
63KB

MD5
16ce1f74f05d3243209164a98bea3502

SHA1
cfc37bfe7139ea769b4c3347e37553e6390bd584

SHA256
11b7c645bb2c23dc146ffe37d319644b1890bec7d2d3dee4ebcc6306e94250c0

SHA512
7a0d2cfe4716f10bca470ff695a21c05ed19a82ee83f283e16e8dfa7c848357059598b2964c52999bfd6232384b6c39c9d6d3cf5fe02380591fc0d576ac4377a

Download Submit
memory/560-35-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

Filesize
9.9MB

Download
memory/560-15-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

Filesize
9.9MB

Download
memory/560-9-0x0000000000F50000-0x0000000000F66000-memory.dmp

Filesize
88KB

Download
memory/560-37-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

Filesize
9.9MB

Download
memory/560-36-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

Filesize
9.9MB

Download
memory/1484-1-0x0000000000B50000-0x0000000000BD2000-memory.dmp

Filesize
520KB

Download
memory/1484-0-0x000007FEF5EA3000-0x000007FEF5EA4000-memory.dmp

Filesize
4KB

Download
memory/2264-14-0x0000000000910000-0x00000000009C2000-memory.dmp

Filesize
712KB

Download
memory/2264-16-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/2832-21-0x000000001B550000-0x000000001B832000-memory.dmp

Filesize
2.9MB

Download
memory/2832-22-0x0000000002050000-0x0000000002058000-memory.dmp

Filesize
32KB

Download
memory/2928-28-0x000000001B600000-0x000000001B8E2000-memory.dmp

Filesize
2.9MB

Download
memory/2928-29-0x0000000002870000-0x0000000002878000-memory.dmp

Filesize
32KB

Download