xworm | 7f1beb32d0565e8ebe9db45b1bc9a29b8fe6f2cfb7f17605bd2f6ec40f761b89

Analysis

max time kernel
143s
max time network
131s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c4c8e3473b0c8f8a1d81b941495d80c1d07fc22d02cd10dc467f4309645d2e2.exe
Size

770KB
MD5

512de90549a0ffd01db566d4e69afa97
SHA1

193cce38892758314db86d16fbc1e6a07008729c
SHA256

5c4c8e3473b0c8f8a1d81b941495d80c1d07fc22d02cd10dc467f4309645d2e2
SHA512

fdbe1b71231057d8b1c25c9a152a846d0860f5f9a3e1942a877f691d5f39e702fafe14b0e9a2e7e21dfa427fed6d20b6fe33109dd82a53fda7b2271ed9c7b177
SSDEEP

12288:2Cg/vC4AAY6NkAI9gNoDUCvUMMyRx0E6eKJQ0qnkf29Bq:2C4vCNAEAwgNIUUz0E1KJQBnkMq

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

127.0.0.1:7000

Attributes

install_file
USB.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral29/files/0x00070000000120ea-5.dat	family_xworm
behavioral29/memory/2876-7-0x0000000001290000-0x00000000012A2000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Executes dropped EXE 18 IoCs

pid	Process
2876	XClient.exe
2224	Output.exe
2652	XClient.exe
2968	Output.exe
2672	XClient.exe
2620	Output.exe
2480	XClient.exe
2240	Output.exe
1148	XClient.exe
996	Output.exe
2164	XClient.exe
2980	Output.exe
2844	XClient.exe
2940	Output.exe
3048	XClient.exe
1812	Output.exe
2792	XClient.exe
308	Output.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2876	XClient.exe
Token: SeDebugPrivilege	2652	XClient.exe
Token: SeDebugPrivilege	2672	XClient.exe
Token: SeDebugPrivilege	2480	XClient.exe
Token: SeDebugPrivilege	1148	XClient.exe
Token: SeDebugPrivilege	2164	XClient.exe
Token: SeDebugPrivilege	2844	XClient.exe
Token: SeDebugPrivilege	3048	XClient.exe
Token: SeDebugPrivilege	2792	XClient.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2876	1820	5c4c8e3473b0c8f8a1d81b941495d80c1d07fc22d02cd10dc467f4309645d2e2.exe	30
PID 1820 wrote to memory of 2876	1820	5c4c8e3473b0c8f8a1d81b941495d80c1d07fc22d02cd10dc467f4309645d2e2.exe	30
PID 1820 wrote to memory of 2876	1820	5c4c8e3473b0c8f8a1d81b941495d80c1d07fc22d02cd10dc467f4309645d2e2.exe	30
PID 1820 wrote to memory of 2224	1820	5c4c8e3473b0c8f8a1d81b941495d80c1d07fc22d02cd10dc467f4309645d2e2.exe	31
PID 1820 wrote to memory of 2224	1820	5c4c8e3473b0c8f8a1d81b941495d80c1d07fc22d02cd10dc467f4309645d2e2.exe	31
PID 1820 wrote to memory of 2224	1820	5c4c8e3473b0c8f8a1d81b941495d80c1d07fc22d02cd10dc467f4309645d2e2.exe	31
PID 2224 wrote to memory of 2652	2224	Output.exe	32
PID 2224 wrote to memory of 2652	2224	Output.exe	32
PID 2224 wrote to memory of 2652	2224	Output.exe	32
PID 2224 wrote to memory of 2968	2224	Output.exe	33
PID 2224 wrote to memory of 2968	2224	Output.exe	33
PID 2224 wrote to memory of 2968	2224	Output.exe	33
PID 2968 wrote to memory of 2672	2968	Output.exe	34
PID 2968 wrote to memory of 2672	2968	Output.exe	34
PID 2968 wrote to memory of 2672	2968	Output.exe	34
PID 2968 wrote to memory of 2620	2968	Output.exe	35
PID 2968 wrote to memory of 2620	2968	Output.exe	35
PID 2968 wrote to memory of 2620	2968	Output.exe	35
PID 2620 wrote to memory of 2480	2620	Output.exe	36
PID 2620 wrote to memory of 2480	2620	Output.exe	36
PID 2620 wrote to memory of 2480	2620	Output.exe	36
PID 2620 wrote to memory of 2240	2620	Output.exe	37
PID 2620 wrote to memory of 2240	2620	Output.exe	37
PID 2620 wrote to memory of 2240	2620	Output.exe	37
PID 2240 wrote to memory of 1148	2240	Output.exe	38
PID 2240 wrote to memory of 1148	2240	Output.exe	38
PID 2240 wrote to memory of 1148	2240	Output.exe	38
PID 2240 wrote to memory of 996	2240	Output.exe	39
PID 2240 wrote to memory of 996	2240	Output.exe	39
PID 2240 wrote to memory of 996	2240	Output.exe	39
PID 996 wrote to memory of 2164	996	Output.exe	40
PID 996 wrote to memory of 2164	996	Output.exe	40
PID 996 wrote to memory of 2164	996	Output.exe	40
PID 996 wrote to memory of 2980	996	Output.exe	41
PID 996 wrote to memory of 2980	996	Output.exe	41
PID 996 wrote to memory of 2980	996	Output.exe	41
PID 2980 wrote to memory of 2844	2980	Output.exe	42
PID 2980 wrote to memory of 2844	2980	Output.exe	42
PID 2980 wrote to memory of 2844	2980	Output.exe	42
PID 2980 wrote to memory of 2940	2980	Output.exe	43
PID 2980 wrote to memory of 2940	2980	Output.exe	43
PID 2980 wrote to memory of 2940	2980	Output.exe	43
PID 2940 wrote to memory of 3048	2940	Output.exe	44
PID 2940 wrote to memory of 3048	2940	Output.exe	44
PID 2940 wrote to memory of 3048	2940	Output.exe	44
PID 2940 wrote to memory of 1812	2940	Output.exe	45
PID 2940 wrote to memory of 1812	2940	Output.exe	45
PID 2940 wrote to memory of 1812	2940	Output.exe	45
PID 1812 wrote to memory of 2792	1812	Output.exe	46
PID 1812 wrote to memory of 2792	1812	Output.exe	46
PID 1812 wrote to memory of 2792	1812	Output.exe	46
PID 1812 wrote to memory of 308	1812	Output.exe	47
PID 1812 wrote to memory of 308	1812	Output.exe	47
PID 1812 wrote to memory of 308	1812	Output.exe	47

C:\Users\Admin\AppData\Local\Temp\5c4c8e3473b0c8f8a1d81b941495d80c1d07fc22d02cd10dc467f4309645d2e2.exe
"C:\Users\Admin\AppData\Local\Temp\5c4c8e3473b0c8f8a1d81b941495d80c1d07fc22d02cd10dc467f4309645d2e2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Users\Admin\AppData\Roaming\XClient.exe
  "C:\Users\Admin\AppData\Roaming\XClient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2876
- C:\Users\Admin\AppData\Roaming\Output.exe
  "C:\Users\Admin\AppData\Roaming\Output.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Users\Admin\AppData\Roaming\XClient.exe
    "C:\Users\Admin\AppData\Roaming\XClient.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2652
- - C:\Users\Admin\AppData\Roaming\Output.exe
    "C:\Users\Admin\AppData\Roaming\Output.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\Users\Admin\AppData\Roaming\XClient.exe
      "C:\Users\Admin\AppData\Roaming\XClient.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2672
  - - C:\Users\Admin\AppData\Roaming\Output.exe
      "C:\Users\Admin\AppData\Roaming\Output.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2620
    - - C:\Users\Admin\AppData\Roaming\XClient.exe
        
        "C:\Users\Admin\AppData\Roaming\XClient.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2480
    - - C:\Users\Admin\AppData\Roaming\Output.exe
        
        "C:\Users\Admin\AppData\Roaming\Output.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2240
      - C:\Users\Admin\AppData\Roaming\XClient.exe
        
        "C:\Users\Admin\AppData\Roaming\XClient.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1148
      - C:\Users\Admin\AppData\Roaming\Output.exe
        
        "C:\Users\Admin\AppData\Roaming\Output.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:996
        
        C:\Users\Admin\AppData\Roaming\XClient.exe
        
        "C:\Users\Admin\AppData\Roaming\XClient.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2164
        
        C:\Users\Admin\AppData\Roaming\Output.exe
        
        "C:\Users\Admin\AppData\Roaming\Output.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2980
        
        C:\Users\Admin\AppData\Roaming\XClient.exe
        
        "C:\Users\Admin\AppData\Roaming\XClient.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2844
        
        C:\Users\Admin\AppData\Roaming\Output.exe
        
        "C:\Users\Admin\AppData\Roaming\Output.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2940
        
        C:\Users\Admin\AppData\Roaming\XClient.exe
        
        "C:\Users\Admin\AppData\Roaming\XClient.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3048
        
        C:\Users\Admin\AppData\Roaming\Output.exe
        
        "C:\Users\Admin\AppData\Roaming\Output.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1812
        
        C:\Users\Admin\AppData\Roaming\XClient.exe
        
        "C:\Users\Admin\AppData\Roaming\XClient.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2792
        
        C:\Users\Admin\AppData\Roaming\Output.exe
        
        "C:\Users\Admin\AppData\Roaming\Output.exe"
        10⤵
        Executes dropped EXE
        
        PID:308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Output.exe

Filesize
707KB

MD5
96c50f871ceb7ee1a0b41dcca8da5c01

SHA1
d8946f0af6156c6f69895a2808734d2696660ada

SHA256
cef4f0409df2a015e20411fdf8317582dc6ed5f56993dd0122b8006cd695c1db

SHA512
0ac872561e55a4c2cea0cd6aab965637b4ee6945552aee0a9b1e28ba338d065f98e782e433f7e3ccd464f18bc2ba14307b453ab2b3de8172a7f186018008802e

Download Submit
C:\Users\Admin\AppData\Roaming\XClient.exe

Filesize
50KB

MD5
e0918682feb10b28a39a9cfbf4d2d90c

SHA1
c33f8518747e96955387bac3c8299eea24357fe0

SHA256
8f7a69675281f0e5f2fd0b43c64434fdb132fdca1eb82cf23aa947f83c833d01

SHA512
dcb3961832197bf33b4e554a69b95a17c847fccde7211ca96ee0a9ad975a051f93e6f29a3a9525279b2aaf9d6b7208a8ddeb8c1d430e79ddf4155f5629038fa7

Download Submit
memory/1820-0-0x000007FEF5073000-0x000007FEF5074000-memory.dmp

Filesize
4KB

Download
memory/1820-1-0x00000000013A0000-0x0000000001466000-memory.dmp

Filesize
792KB

Download
memory/2224-13-0x0000000001220000-0x00000000012D8000-memory.dmp

Filesize
736KB

Download
memory/2876-7-0x0000000001290000-0x00000000012A2000-memory.dmp

Filesize
72KB

Download
memory/2876-30-0x000007FEF5070000-0x000007FEF5A5C000-memory.dmp

Filesize
9.9MB

Download
memory/2876-31-0x000007FEF5070000-0x000007FEF5A5C000-memory.dmp

Filesize
9.9MB

Download
memory/2876-32-0x000007FEF5070000-0x000007FEF5A5C000-memory.dmp

Filesize
9.9MB

Download
memory/2876-33-0x000007FEF5070000-0x000007FEF5A5C000-memory.dmp

Filesize
9.9MB

Download