xworm | f3aa2b23a67f4dbcce9fff7bb084e70127e3e0c4f2ab0f605487c570a7408960

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f8921f28520259dde636ae0740e643e.exe
Size

83KB
MD5

6f8921f28520259dde636ae0740e643e
SHA1

7ef37a82084aab44a4244686caab989782fe6429
SHA256

6227c2875367575c19077a8862756f5fc68e4d6b3d927141a53b754ac92b6b96
SHA512

662fbf92d10fc3be43db9696e6c3b3d070006ec0aed2fd0839eee953e7b0967fd13b6a3c14a19540225fb7839c076716f7ebb74ec99c7a74d9117e462aba447a
SSDEEP

1536:77triqtB0GeR5d1DXi/nRlacAXoLvo+b4dB/jwpV2ooVZ2HsFz+V6HyKpOamqVsC:9ri1DXYRnAYM+b4P/4oz2Mca1OaDKC

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

26.ip.gl.ply.gg:14526

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral19/memory/2744-1-0x0000000000860000-0x000000000087C000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2076	powershell.exe
2812	powershell.exe
2992	powershell.exe
2676	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	6f8921f28520259dde636ae0740e643e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2076	powershell.exe
2812	powershell.exe
2992	powershell.exe
2676	powershell.exe
2744	6f8921f28520259dde636ae0740e643e.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2744	6f8921f28520259dde636ae0740e643e.exe
Token: SeDebugPrivilege	2076	powershell.exe
Token: SeDebugPrivilege	2812	powershell.exe
Token: SeDebugPrivilege	2992	powershell.exe
Token: SeDebugPrivilege	2676	powershell.exe
Token: SeDebugPrivilege	2744	6f8921f28520259dde636ae0740e643e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2744	6f8921f28520259dde636ae0740e643e.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2076	2744	6f8921f28520259dde636ae0740e643e.exe	30
PID 2744 wrote to memory of 2076	2744	6f8921f28520259dde636ae0740e643e.exe	30
PID 2744 wrote to memory of 2076	2744	6f8921f28520259dde636ae0740e643e.exe	30
PID 2744 wrote to memory of 2812	2744	6f8921f28520259dde636ae0740e643e.exe	32
PID 2744 wrote to memory of 2812	2744	6f8921f28520259dde636ae0740e643e.exe	32
PID 2744 wrote to memory of 2812	2744	6f8921f28520259dde636ae0740e643e.exe	32
PID 2744 wrote to memory of 2992	2744	6f8921f28520259dde636ae0740e643e.exe	34
PID 2744 wrote to memory of 2992	2744	6f8921f28520259dde636ae0740e643e.exe	34
PID 2744 wrote to memory of 2992	2744	6f8921f28520259dde636ae0740e643e.exe	34
PID 2744 wrote to memory of 2676	2744	6f8921f28520259dde636ae0740e643e.exe	36
PID 2744 wrote to memory of 2676	2744	6f8921f28520259dde636ae0740e643e.exe	36
PID 2744 wrote to memory of 2676	2744	6f8921f28520259dde636ae0740e643e.exe	36

C:\Users\Admin\AppData\Local\Temp\6f8921f28520259dde636ae0740e643e.exe
"C:\Users\Admin\AppData\Local\Temp\6f8921f28520259dde636ae0740e643e.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\6f8921f28520259dde636ae0740e643e.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '6f8921f28520259dde636ae0740e643e.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
a9f907f17822c62c036271873d261d81

SHA1
05521becca0f13d3c6f6ee47a4bc2d240fdb9abc

SHA256
24a3dbb9812135fa130f186cf3d9c9ce9fceb578c7e7096bb5a3cefb573aa400

SHA512
e142707cfcaa19184cf7113fe62f9c070507e13966d254e30eae15d9f71a6728aa630bef90fecf28d7b205e7b48bf807b2f94ed16536f86d51685980fbd3202c

Download Submit
memory/2076-6-0x0000000002AA0000-0x0000000002B20000-memory.dmp

Filesize
512KB

Download
memory/2076-7-0x000000001B740000-0x000000001BA22000-memory.dmp

Filesize
2.9MB

Download
memory/2076-8-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/2744-0-0x000007FEF5AF3000-0x000007FEF5AF4000-memory.dmp

Filesize
4KB

Download
memory/2744-1-0x0000000000860000-0x000000000087C000-memory.dmp

Filesize
112KB

Download
memory/2744-28-0x000000001B140000-0x000000001B1C0000-memory.dmp

Filesize
512KB

Download
memory/2744-29-0x000007FEF5AF3000-0x000007FEF5AF4000-memory.dmp

Filesize
4KB

Download
memory/2744-30-0x000000001B140000-0x000000001B1C0000-memory.dmp

Filesize
512KB

Download
memory/2812-14-0x000000001B600000-0x000000001B8E2000-memory.dmp

Filesize
2.9MB

Download
memory/2812-15-0x0000000002910000-0x0000000002918000-memory.dmp

Filesize
32KB

Download