xworm | e7d94fea51639e52733278489a3d3efe05a4ac7e0e14b1e8c09705c0c2bed602

General

Target
e7d94fea51639e52733278489a3d3efe05a4ac7e0e14b1e8c09705c0c2bed602.exe
Size 2.1MB
Sample260810-r94fva1eja
SHA256 e7d94fea51639e52733278489a3d3efe05a4ac7e0e14b1e8c09705c0c2bed602
MD5 2fe0e6a75bb845a357aa354e6b9047eb
SHA1 771cd64c9e1d2d32187bebe22eaf360590cd39aa
SHA512 21180eec4ca6e928016b9b11aa6b38ada3e9d8fc73c2f3fdc3975c5b02e215a2d3360a144f5bd4b7751612401069f4ac498093005fef28c806874c68c43fbabc
SSDEEP 49152:nlGSiCDMHirjJw/gG1ePK6nFhcCXt1INiHNm3pLZi86gzz:nlHS6PXt1INiHNm3pLZi86gzz
TLSH
T1D9A5BE19E3D815B8D167DA38CB61A332C6B178524771E58F0A99D70A2F77E908F3B312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

DHL823M568VVfh9x

Attributes

install_file
USB.exe
localhost
127.0.0.1

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/5708-1-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Executes dropped EXE 1 IoCs

pid	Process
1620	e7d94fea51639e52733278489a3d3efe05a4ac7e0e14b1e8c09705c0c2bed602.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AppData = "cmd /c start \"\" /D \"C:\\ProgramData\\AppData\" e7d94fea51639e52733278489a3d3efe05a4ac7e0e14b1e8c09705c0c2bed602.exe"	e7d94fea51639e52733278489a3d3efe05a4ac7e0e14b1e8c09705c0c2bed602.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3640 set thread context of 5708	3640	e7d94fea51639e52733278489a3d3efe05a4ac7e0e14b1e8c09705c0c2bed602.exe	88
PID 1620 set thread context of 4440	1620	e7d94fea51639e52733278489a3d3efe05a4ac7e0e14b1e8c09705c0c2bed602.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3640	e7d94fea51639e52733278489a3d3efe05a4ac7e0e14b1e8c09705c0c2bed602.exe
Token: SeDebugPrivilege	1620	e7d94fea51639e52733278489a3d3efe05a4ac7e0e14b1e8c09705c0c2bed602.exe
Token: SeDebugPrivilege	5708	jsc.exe
Token: SeDebugPrivilege	4440	jsc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 5708	3640	e7d94fea51639e52733278489a3d3efe05a4ac7e0e14b1e8c09705c0c2bed602.exe	88
PID 3640 wrote to memory of 5708	3640	e7d94fea51639e52733278489a3d3efe05a4ac7e0e14b1e8c09705c0c2bed602.exe	88
PID 3640 wrote to memory of 5708	3640	e7d94fea51639e52733278489a3d3efe05a4ac7e0e14b1e8c09705c0c2bed602.exe	88
PID 3640 wrote to memory of 5708	3640	e7d94fea51639e52733278489a3d3efe05a4ac7e0e14b1e8c09705c0c2bed602.exe	88
PID 3640 wrote to memory of 5708	3640	e7d94fea51639e52733278489a3d3efe05a4ac7e0e14b1e8c09705c0c2bed602.exe	88
PID 3264 wrote to memory of 1620	3264	cmd.exe	91
PID 1620 wrote to memory of 4440	1620	e7d94fea51639e52733278489a3d3efe05a4ac7e0e14b1e8c09705c0c2bed602.exe	92
PID 1620 wrote to memory of 4440	1620	e7d94fea51639e52733278489a3d3efe05a4ac7e0e14b1e8c09705c0c2bed602.exe	92
PID 1620 wrote to memory of 4440	1620	e7d94fea51639e52733278489a3d3efe05a4ac7e0e14b1e8c09705c0c2bed602.exe	92
PID 1620 wrote to memory of 4440	1620	e7d94fea51639e52733278489a3d3efe05a4ac7e0e14b1e8c09705c0c2bed602.exe	92
PID 1620 wrote to memory of 4440	1620	e7d94fea51639e52733278489a3d3efe05a4ac7e0e14b1e8c09705c0c2bed602.exe	92

C:\Users\Admin\AppData\Local\Temp\e7d94fea51639e52733278489a3d3efe05a4ac7e0e14b1e8c09705c0c2bed602.exe
"C:\Users\Admin\AppData\Local\Temp\e7d94fea51639e52733278489a3d3efe05a4ac7e0e14b1e8c09705c0c2bed602.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5708

C:\Windows\system32\cmd.exe
"cmd /c start "" /D "C:\ProgramData\AppData" e7d94fea51639e52733278489a3d3efe05a4ac7e0e14b1e8c09705c0c2bed602.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3264
- C:\ProgramData\AppData\e7d94fea51639e52733278489a3d3efe05a4ac7e0e14b1e8c09705c0c2bed602.exe
  "C:\ProgramData\AppData\e7d94fea51639e52733278489a3d3efe05a4ac7e0e14b1e8c09705c0c2bed602.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e7d94fea51639e52733278489a3d3efe05a4ac7e0e14b1e8c09705c0c2bed602.exe

Path C:\ProgramData\AppData\e7d94fea51639e52733278489a3d3efe05a4ac7e0e14b1e8c09705c0c2bed602.exe
Size 2.1MB
SHA256 e7d94fea51639e52733278489a3d3efe05a4ac7e0e14b1e8c09705c0c2bed602
MD5 2fe0e6a75bb845a357aa354e6b9047eb
SHA1 771cd64c9e1d2d32187bebe22eaf360590cd39aa
SHA512 21180eec4ca6e928016b9b11aa6b38ada3e9d8fc73c2f3fdc3975c5b02e215a2d3360a144f5bd4b7751612401069f4ac498093005fef28c806874c68c43fbabc
SSDEEP 49152:nlGSiCDMHirjJw/gG1ePK6nFhcCXt1INiHNm3pLZi86gzz:nlHS6PXt1INiHNm3pLZi86gzz
TLSH
T1D9A5BE19E3D815B8D167DA38CB61A332C6B178524771E58F0A99D70A2F77E908F3B312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5708-1-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/5708-2-0x0000000074E22000-0x0000000074E23000-memory.dmp

Download

memory/5708-3-0x0000000005250000-0x00000000052EC000-memory.dmp

Download

memory/5708-7-0x0000000074E10000-0x00000000755CC000-memory.dmp

Download

memory/5708-8-0x0000000074E22000-0x0000000074E23000-memory.dmp

Download

memory/5708-9-0x0000000074E10000-0x00000000755CC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads