xworm | 035f3f8b41ce77cec7bd3f09ffaadc4a49b68543122de5d2be0f58c1228db026

General

Target
x035f3f8b41ce77cec7bd3f09ffaadc4a49b68543122de5d2be0f58c1228db026.exe
Size 1.4MB
Sample260523-e3spjsfw6s
SHA256 035f3f8b41ce77cec7bd3f09ffaadc4a49b68543122de5d2be0f58c1228db026
MD5 f1a363eeb8332023c8ab2fb68f0bcd33
SHA1 87a7e34559a10a56f232ee9ecc84542516c930cf
SHA512 fc71776eae0309d5b2547f16b861846a236ad27063e53baa8e1f72c09466135f6f1143dd0673a114b97db66da0afe5bd84f7672b961399f05cb014e8af483ace
SSDEEP 24576:IyngUGSUHs5q8dXY3aWnEz0GhxEww3mbFXg5TpTv5uTc/cuw:mHHs5/EaWEzVHEh2bl2pTETMcF
TLSH
T169657D07F69500FCD06AC1B8CA569522EA71BC860F71AADF1790A3292F77AE05F3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

XWorm V5.6

Attributes

Install_directory
%LocalAppData%
install_file
USB.exe
pastebin_url
https://pastebin.com/raw/Fxzr3jeT

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x001a00000002b47f-4.dat	family_xworm
behavioral2/memory/2168-12-0x0000000000180000-0x0000000000196000-memory.dmp	family_xworm

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.lnk	audiodg.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.lnk	audiodg.exe

Executes dropped EXE 1 IoCs

pid	Process
2168	audiodg.exe

Modifies system executable filetype association 2 TTPs 3 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	x035f3f8b41ce77cec7bd3f09ffaadc4a49b68543122de5d2be0f58c1228db026.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	x035f3f8b41ce77cec7bd3f09ffaadc4a49b68543122de5d2be0f58c1228db026.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	x035f3f8b41ce77cec7bd3f09ffaadc4a49b68543122de5d2be0f58c1228db026.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "C:\\Users\\Admin\\AppData\\Local\\winlogon"	audiodg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
5	pastebin.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	x035f3f8b41ce77cec7bd3f09ffaadc4a49b68543122de5d2be0f58c1228db026.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	x035f3f8b41ce77cec7bd3f09ffaadc4a49b68543122de5d2be0f58c1228db026.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	x035f3f8b41ce77cec7bd3f09ffaadc4a49b68543122de5d2be0f58c1228db026.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2168	audiodg.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 2168	5024	x035f3f8b41ce77cec7bd3f09ffaadc4a49b68543122de5d2be0f58c1228db026.exe	80

C:\Users\Admin\AppData\Local\Temp\x035f3f8b41ce77cec7bd3f09ffaadc4a49b68543122de5d2be0f58c1228db026.exe
"C:\Users\Admin\AppData\Local\Temp\x035f3f8b41ce77cec7bd3f09ffaadc4a49b68543122de5d2be0f58c1228db026.exe"
1⤵
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Users\Admin\Documents\diagnostics\audiodg.exe
  "C:\Users\Admin\Documents\diagnostics\audiodg.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:2168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

audiodg.exe

Path C:\Users\Admin\Documents\diagnostics\audiodg.exe
Size 62KB
SHA256 76957a7db92abf1667474a4e45477cea7297e9a25c78c1fadd94795fc5390833
MD5 9367eafefd3471a59df9ee9ffa198573
SHA1 e944938360ba8825ba0bed160c74d7985a6bc833
SHA512 a1ac5d7c0429a9f2e968a94433547c672f9d060257cb66857c265b28a6783c8abfb7ba400495c50ef0c1c9b1a8a4fc209eca57b086f99af8d3d5af5d05a94b4a
SSDEEP 1536:QAw5A/msOFA3asSkD6nFHbAVecYpVwaExJO1EA+Bdd:QE/msHasdDOFHbAMCaExJO1Ebdd
TLSH
T1A2537C18BBE54129E5BF6FB159F13276DB39F7635903862F28C5028B1A23E85CD006F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2168-12-0x0000000000180000-0x0000000000196000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads