xworm | 7f1beb32d0565e8ebe9db45b1bc9a29b8fe6f2cfb7f17605bd2f6ec40f761b89

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c55fbcb2e826d47b9446973666e9dfbb429c5e37581d6641b0cf2528649ef2a.exe
Size

495KB
MD5

4f0cb3352c75a47e9fb8cc3a08fe62fc
SHA1

7f992fe7e02920b6e81a8375e7783d3ff3ec8594
SHA256

5c55fbcb2e826d47b9446973666e9dfbb429c5e37581d6641b0cf2528649ef2a
SHA512

7ba555345f6acfb3bd9351f96d56891e7529f393d03ea557c0ed796ece46ca2103e082d648b9b472168ba37abcacf18bab98c1facc6b4e80be06f8ca6ab5bd39
SSDEEP

6144:SrUyLo6Ne40BlxE4F459KSLUKF2U6B/Z3InJv6jsyZIf78p33MYn65lMDKEmcSpM:SQb6Ne405E4aqYU1SUZO8pnMXADdSl

Score

10^/10

xworm discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

or-city.gl.at.ply.gg:62747

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral31/files/0x000d00000001202b-6.dat	family_xworm
behavioral31/memory/2624-11-0x0000000000B80000-0x0000000000B96000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2928	powershell.exe
3060	powershell.exe
2684	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
2624	WizClient211ё.exe
2988	!Automatic error fixer by lowcode.exe
2952	WizClient211ё.exe
584	WizClient211ё.exe
1840	WizClient211ё.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\WizClient211ё = "C:\\Users\\Admin\\AppData\\Roaming\\WizClient211ё.exe"	WizClient211ё.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2988	!Automatic error fixer by lowcode.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!Automatic error fixer by lowcode.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	WizClient211ё.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	WizClient211ё.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1280	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2928	powershell.exe
3060	powershell.exe
2684	powershell.exe
2624	WizClient211ё.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2624	WizClient211ё.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	3060	powershell.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeDebugPrivilege	2624	WizClient211ё.exe
Token: SeDebugPrivilege	2952	WizClient211ё.exe
Token: SeDebugPrivilege	584	WizClient211ё.exe
Token: SeDebugPrivilege	1840	WizClient211ё.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2624	WizClient211ё.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 2624	2592	5c55fbcb2e826d47b9446973666e9dfbb429c5e37581d6641b0cf2528649ef2a.exe	30
PID 2592 wrote to memory of 2624	2592	5c55fbcb2e826d47b9446973666e9dfbb429c5e37581d6641b0cf2528649ef2a.exe	30
PID 2592 wrote to memory of 2624	2592	5c55fbcb2e826d47b9446973666e9dfbb429c5e37581d6641b0cf2528649ef2a.exe	30
PID 2592 wrote to memory of 2988	2592	5c55fbcb2e826d47b9446973666e9dfbb429c5e37581d6641b0cf2528649ef2a.exe	31
PID 2592 wrote to memory of 2988	2592	5c55fbcb2e826d47b9446973666e9dfbb429c5e37581d6641b0cf2528649ef2a.exe	31
PID 2592 wrote to memory of 2988	2592	5c55fbcb2e826d47b9446973666e9dfbb429c5e37581d6641b0cf2528649ef2a.exe	31
PID 2592 wrote to memory of 2988	2592	5c55fbcb2e826d47b9446973666e9dfbb429c5e37581d6641b0cf2528649ef2a.exe	31
PID 2624 wrote to memory of 2928	2624	WizClient211ё.exe	33
PID 2624 wrote to memory of 2928	2624	WizClient211ё.exe	33
PID 2624 wrote to memory of 2928	2624	WizClient211ё.exe	33
PID 2624 wrote to memory of 3060	2624	WizClient211ё.exe	35
PID 2624 wrote to memory of 3060	2624	WizClient211ё.exe	35
PID 2624 wrote to memory of 3060	2624	WizClient211ё.exe	35
PID 2624 wrote to memory of 2684	2624	WizClient211ё.exe	37
PID 2624 wrote to memory of 2684	2624	WizClient211ё.exe	37
PID 2624 wrote to memory of 2684	2624	WizClient211ё.exe	37
PID 2624 wrote to memory of 1280	2624	WizClient211ё.exe	39
PID 2624 wrote to memory of 1280	2624	WizClient211ё.exe	39
PID 2624 wrote to memory of 1280	2624	WizClient211ё.exe	39
PID 2740 wrote to memory of 2952	2740	taskeng.exe	43
PID 2740 wrote to memory of 2952	2740	taskeng.exe	43
PID 2740 wrote to memory of 2952	2740	taskeng.exe	43
PID 2740 wrote to memory of 584	2740	taskeng.exe	44
PID 2740 wrote to memory of 584	2740	taskeng.exe	44
PID 2740 wrote to memory of 584	2740	taskeng.exe	44
PID 2740 wrote to memory of 1840	2740	taskeng.exe	45
PID 2740 wrote to memory of 1840	2740	taskeng.exe	45
PID 2740 wrote to memory of 1840	2740	taskeng.exe	45

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\5c55fbcb2e826d47b9446973666e9dfbb429c5e37581d6641b0cf2528649ef2a.exe
"C:\Users\Admin\AppData\Local\Temp\5c55fbcb2e826d47b9446973666e9dfbb429c5e37581d6641b0cf2528649ef2a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Users\Admin\AppData\Roaming\WizClient211ё.exe
  "C:\Users\Admin\AppData\Roaming\WizClient211ё.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WizClient211ё.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WizClient211ё.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WizClient211ё.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2684
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WizClient211ё" /tr "C:\Users\Admin\AppData\Roaming\WizClient211ё.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1280
- C:\Users\Admin\AppData\Roaming\!Automatic error fixer by lowcode.exe
  "C:\Users\Admin\AppData\Roaming\!Automatic error fixer by lowcode.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:2988

C:\Windows\system32\taskeng.exe
taskeng.exe {E26606D9-F99F-4E07-99E4-E085A21A77F3} S-1-5-21-1163522206-1469769407-485553996-1000:PJCSDMRP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Users\Admin\AppData\Roaming\WizClient211ё.exe
  C:\Users\Admin\AppData\Roaming\WizClient211ё.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2952
- C:\Users\Admin\AppData\Roaming\WizClient211ё.exe
  C:\Users\Admin\AppData\Roaming\WizClient211ё.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:584
- C:\Users\Admin\AppData\Roaming\WizClient211ё.exe
  C:\Users\Admin\AppData\Roaming\WizClient211ё.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\!Automatic error fixer by lowcode.exe

Filesize
421KB

MD5
7872ea21c0bb3f03911e7029a5735a6c

SHA1
bf05a9de2aff6b19eeef389d0eccd10ee49f96b8

SHA256
f614a98a634cdd99bf0945c65ce041f891da4fb4f0aeee6e59397347793ab8a7

SHA512
e5765d47e2010eab477ec3743b3ee8093d9cc6295f2abf6470d81cee83ba50e566b2ae5cfb34238d375e9536a88060f2f7a76f3ee9f68c21e6517da90097209d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
727eac2174a046d3b77c1f3622e262a6

SHA1
52f299b3b4a3fdf0ce06bdaccf4526585c65c7a8

SHA256
fe43de93f9148c207c31f5d7fe10dc650a95393495b60525dcba80602030418e

SHA512
348fd05f754b9e5bb2f254df9a124cfca7778866201d7deb038c21d59aec4dd930b76121f3b78fb8bcd611467a20a6c865f4f9ff9d5f382bc591f053564b3540

Download Submit
C:\Users\Admin\AppData\Roaming\WizClient211ё.exe

Filesize
63KB

MD5
16ce1f74f05d3243209164a98bea3502

SHA1
cfc37bfe7139ea769b4c3347e37553e6390bd584

SHA256
11b7c645bb2c23dc146ffe37d319644b1890bec7d2d3dee4ebcc6306e94250c0

SHA512
7a0d2cfe4716f10bca470ff695a21c05ed19a82ee83f283e16e8dfa7c848357059598b2964c52999bfd6232384b6c39c9d6d3cf5fe02380591fc0d576ac4377a

Download Submit
memory/2592-1-0x0000000000360000-0x00000000003E2000-memory.dmp

Filesize
520KB

Download
memory/2592-0-0x000007FEF53B3000-0x000007FEF53B4000-memory.dmp

Filesize
4KB

Download
memory/2624-11-0x0000000000B80000-0x0000000000B96000-memory.dmp

Filesize
88KB

Download
memory/2624-38-0x000007FEF53B0000-0x000007FEF5D9C000-memory.dmp

Filesize
9.9MB

Download
memory/2624-15-0x000007FEF53B0000-0x000007FEF5D9C000-memory.dmp

Filesize
9.9MB

Download
memory/2624-36-0x000007FEF53B0000-0x000007FEF5D9C000-memory.dmp

Filesize
9.9MB

Download
memory/2624-35-0x000007FEF53B0000-0x000007FEF5D9C000-memory.dmp

Filesize
9.9MB

Download
memory/2928-22-0x0000000001FD0000-0x0000000001FD8000-memory.dmp

Filesize
32KB

Download
memory/2928-21-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/2988-16-0x00000000004E0000-0x00000000004E1000-memory.dmp

Filesize
4KB

Download
memory/2988-14-0x0000000001060000-0x0000000001112000-memory.dmp

Filesize
712KB

Download
memory/3060-28-0x000000001B660000-0x000000001B942000-memory.dmp

Filesize
2.9MB

Download
memory/3060-29-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download