xworm | b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0

Analysis

max time kernel
149s
max time network
139s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 16:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe
Size

80KB
MD5

24e8d2e987904e15845cfed585b57e60
SHA1

6530808d32d9b44d1ff808c2f845520e4c14e320
SHA256

b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0
SHA512

d29f5253fe2e427260c637f585f2025110740ad9e3f32dbb4cf0b3570b7639244075303fbce64b741b5b876cbedcd2f9c16ccc0c3a93fd8f8d23fbcdc0129b5c
SSDEEP

1536:3l35hnx4z7Ziy+AbvsPVbbGhN6BCoCYTk6I9mO3hMOTSdXY:35nyvZSVbbGhsLOmO3hMO0Y

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

127.0.0.1:36622

many-created.gl.at.ply.gg:36622

Attributes

Install_directory
%Temp%
install_file
Power.exe

Signatures

Detect Xworm Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1724-1-0x0000000000C60000-0x0000000000C7A000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Local\Temp\Power.exe	family_xworm
behavioral1/memory/1652-37-0x0000000000C90000-0x0000000000CAA000-memory.dmp	family_xworm
behavioral1/memory/2320-40-0x0000000000DA0000-0x0000000000DBA000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

1956 powershell.exe
2668 powershell.exe
2456 powershell.exe
2564 powershell.exe

pid	process
1956	powershell.exe
2668	powershell.exe
2456	powershell.exe
2564	powershell.exe

Drops startup file 2 IoCs

Processes:

b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Power.lnk	b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Power.lnk	b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe

Executes dropped EXE 2 IoCs

Processes:

Power.exePower.exe

pid process

1652 Power.exe
2320 Power.exe

pid	process
1652	Power.exe
2320	Power.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Power = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Power.exe"	b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2832 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeb2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe

pid process

2456 powershell.exe
2564 powershell.exe
1956 powershell.exe
2668 powershell.exe
1724 b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe

flow	ioc
4	ip-api.com

pid	process
2832	schtasks.exe

pid	process
2456	powershell.exe
2564	powershell.exe
1956	powershell.exe
2668	powershell.exe
1724	b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exepowershell.exepowershell.exepowershell.exepowershell.exePower.exePower.exe

description	pid	process
Token: SeDebugPrivilege	1724	b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2456	powershell.exe
Token: SeDebugPrivilege	2564	powershell.exe
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeDebugPrivilege	1724	b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe
Token: SeDebugPrivilege	1652	Power.exe
Token: SeDebugPrivilege	2320	Power.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe

pid process

1724 b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe

pid	process
1724	b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exetaskeng.exe

description	pid	process	target process
PID 1724 wrote to memory of 2456	1724	b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe	powershell.exe
PID 1724 wrote to memory of 2456	1724	b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe	powershell.exe
PID 1724 wrote to memory of 2456	1724	b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe	powershell.exe
PID 1724 wrote to memory of 2564	1724	b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe	powershell.exe
PID 1724 wrote to memory of 2564	1724	b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe	powershell.exe
PID 1724 wrote to memory of 2564	1724	b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe	powershell.exe
PID 1724 wrote to memory of 1956	1724	b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe	powershell.exe
PID 1724 wrote to memory of 1956	1724	b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe	powershell.exe
PID 1724 wrote to memory of 1956	1724	b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe	powershell.exe
PID 1724 wrote to memory of 2668	1724	b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe	powershell.exe
PID 1724 wrote to memory of 2668	1724	b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe	powershell.exe
PID 1724 wrote to memory of 2668	1724	b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe	powershell.exe
PID 1724 wrote to memory of 2832	1724	b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe	schtasks.exe
PID 1724 wrote to memory of 2832	1724	b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe	schtasks.exe
PID 1724 wrote to memory of 2832	1724	b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe	schtasks.exe
PID 1364 wrote to memory of 1652	1364	taskeng.exe	Power.exe
PID 1364 wrote to memory of 1652	1364	taskeng.exe	Power.exe
PID 1364 wrote to memory of 1652	1364	taskeng.exe	Power.exe
PID 1364 wrote to memory of 2320	1364	taskeng.exe	Power.exe
PID 1364 wrote to memory of 2320	1364	taskeng.exe	Power.exe
PID 1364 wrote to memory of 2320	1364	taskeng.exe	Power.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2456

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2564

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Power.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1956

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Power.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2668

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Power" /tr "C:\Users\Admin\AppData\Local\Temp\Power.exe"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2832

C:\Windows\system32\taskeng.exe
taskeng.exe {BB84262F-84D4-4330-B507-4A594285355E} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1364

C:\Users\Admin\AppData\Local\Temp\Power.exe
C:\Users\Admin\AppData\Local\Temp\Power.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1652

C:\Users\Admin\AppData\Local\Temp\Power.exe
C:\Users\Admin\AppData\Local\Temp\Power.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2320

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Power.exe
Filesize
80KB

MD5
24e8d2e987904e15845cfed585b57e60

SHA1
6530808d32d9b44d1ff808c2f845520e4c14e320

SHA256
b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0

SHA512
d29f5253fe2e427260c637f585f2025110740ad9e3f32dbb4cf0b3570b7639244075303fbce64b741b5b876cbedcd2f9c16ccc0c3a93fd8f8d23fbcdc0129b5c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
c5fcf33901ce513ca7dadd941fe5da16

SHA1
7c6f7cbdfd610f75ed07ce1664390d232a387d43

SHA256
7cd06a349e62363e933f29f78d1ef1dd0b891d4c8a3a91cd8cae6e6cff9a9928

SHA512
a9f999459bdd93b348f0f4726b095c8048a4369c2ef9fbe0e40b7e5daa61cb965cad3e45534bf8bb2c0f52ca4f61cc8b8489be8b2bb5790d213d1bc9f6c94497

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1652-37-0x0000000000C90000-0x0000000000CAA000-memory.dmp

Filesize
104KB

Download
memory/1724-2-0x000007FEF5AC0000-0x000007FEF64AC000-memory.dmp

Filesize
9.9MB

Download
memory/1724-0-0x000007FEF5AC3000-0x000007FEF5AC4000-memory.dmp

Filesize
4KB

Download
memory/1724-32-0x000007FEF5AC3000-0x000007FEF5AC4000-memory.dmp

Filesize
4KB

Download
memory/1724-33-0x000007FEF5AC0000-0x000007FEF64AC000-memory.dmp

Filesize
9.9MB

Download
memory/1724-1-0x0000000000C60000-0x0000000000C7A000-memory.dmp

Filesize
104KB

Download
memory/2320-40-0x0000000000DA0000-0x0000000000DBA000-memory.dmp

Filesize
104KB

Download
memory/2456-7-0x0000000002CD0000-0x0000000002D50000-memory.dmp

Filesize
512KB

Download
memory/2456-8-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Filesize
2.9MB

Download
memory/2456-9-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/2564-15-0x000000001B620000-0x000000001B902000-memory.dmp

Filesize
2.9MB

Download
memory/2564-16-0x0000000002340000-0x0000000002348000-memory.dmp

Filesize
32KB

Download