xworm | 1c880993a9374bf293f63e82d2a88f3ea3bf03b06b5c56913e0055c59d891865

General

Target
XWormClient.rar
Size 42KB
Sample261002-pp6dlawyet
SHA256 1c880993a9374bf293f63e82d2a88f3ea3bf03b06b5c56913e0055c59d891865
MD5 6ea02c9faea00294aec011282b81145f
SHA1 e39ed6e2facf403280b16a87b8c6b96f82d1fefd
SHA512 793a798b774489be6075364b25fd0be8086adb9ec7fc31a28943a0ff2c760025f2e27755bbb8f3798cfc13a8a18b3067d21896fdb5689a9bc9282359b359af8f
SSDEEP 768:35Rr/qqWyJIlcp7TSlKodXWKEQtYbkZ2CylUTNXaj6QCH:JRrizyKlG3Ss4WBHkMs946QCH
TLSH
T1A6130276D2ABA0DC7D33740503F42CF9AD7B790A574066B4EADA1B05AC410B58D3BF8A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence privilege_escalation rat trojan

Malware Config

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000d0000000244a7-3.dat	family_xworm
behavioral1/memory/3796-12-0x0000000000BD0000-0x0000000000BEC000-memory.dmp	family_xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	XWormClient.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.lnk	XWormClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.lnk	XWormClient.exe

Executes dropped EXE 4 IoCs

pid	Process
3796	XWormClient.exe
1076	XWormClient.exe
1504	XWormClient.exe
4116	XWormClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	XWormClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	XWormClient.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3156	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2300	7zFM.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeRestorePrivilege	2300	7zFM.exe
Token: 35	2300	7zFM.exe
Token: SeSecurityPrivilege	2300	7zFM.exe
Token: SeDebugPrivilege	3796	XWormClient.exe
Token: SeDebugPrivilege	3796	XWormClient.exe
Token: SeDebugPrivilege	1504	XWormClient.exe
Token: SeDebugPrivilege	1076	XWormClient.exe
Token: SeDebugPrivilege	4116	XWormClient.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2300	7zFM.exe
2300	7zFM.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 3796	2300	7zFM.exe	107
PID 3796 wrote to memory of 3156	3796	XWormClient.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\XWormClient.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Users\Admin\AppData\Local\Temp\7zOCF8AD66A\XWormClient.exe
  "C:\Users\Admin\AppData\Local\Temp\7zOCF8AD66A\XWormClient.exe"
  2⤵
  - Checks computer location settings
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XWormClient" /tr "C:\ProgramData\XWormClient.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3156

C:\ProgramData\XWormClient.exe
C:\ProgramData\XWormClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1504

C:\PROGRA~3\XWormClient.exe
C:\PROGRA~3\XWORMC~1.EXE
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1076

C:\ProgramData\XWormClient.exe
C:\ProgramData\XWormClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XWormClient.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XWormClient.exe.log
Size 871B
SHA256 7caf8779608c167ab6fa570df00c973aff6dee850bb63439770889a68c7cdae0
MD5 386677f585908a33791517dfc2317f88
SHA1 2e6853b4560a9ac8a74cdd5c3124a777bc0d874e
SHA512 876d2269e25a4b2754bdf2c7e3c410050f885d7e6bd8abce41c5fc74ae1f8c549b2266dd1588c750f614063f36c8a8e5008cea610505897d04e4ef5c3adc52d9
TLSH
T10911C8312231E1C889223F122C2C298452BF0796A690EE0C719092AED9321275F202E7
MD5 SHA1 SHA512 TLSH

Submit Download

XWormClient.exe

Path C:\Users\Admin\AppData\Local\Temp\7zOCF8AD66A\XWormClient.exe
Size 88KB
SHA256 827000eef8e4902f2cc3cf028923654d6cb46736324ae7742df2403c34e8878c
MD5 c6dd8966bcf31e4cc2b21d6ba79c213c
SHA1 2021527af1e94f714965578e84ededfedb4a1a9e
SHA512 2d602fc66b207a0b13904da03b39a0ec3549bb0a3f7ab6f4825743ee733fba17ae8e9087d35640dc60189d5aa842cba1457aea4f9bc2849de6177e5fe717431b
SSDEEP 1536:nKJErJNDJ6a9Jtkhvi7cYh8ZQb6D2/hheu4L+6EF9rt45mE+TXhbe64W+/B:Xl64RfhOQM8eu4LDQ9dXhbe62
TLSH
T10D936C8FF780CA94C55C0E77C693900842AAE4B7763BF77B14C89DE45C224E889CFA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3796-12-0x0000000000BD0000-0x0000000000BEC000-memory.dmp

Download

memory/3796-17-0x000000001D010000-0x000000001D020000-memory.dmp

Download

memory/3796-23-0x000000001D010000-0x000000001D020000-memory.dmp

Download

memory/3796-24-0x000000001E150000-0x000000001E19E000-memory.dmp

Download

memory/3796-25-0x000000001DCE0000-0x000000001DCE6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads