xworm | 04f28f4975a7ff3cb3439b65b8d2fad8e99e3431b65be0e065c194908459790e

Analysis

max time kernel
120s
max time network
135s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Image logger beta.exe
Size

297KB
MD5

f6bc727b25a9d6d15f62d459f2d875d0
SHA1

a7502f6990fc98c4f634ec3e995cc7f443487b13
SHA256

04f28f4975a7ff3cb3439b65b8d2fad8e99e3431b65be0e065c194908459790e
SHA512

b0847c9b037ad9f2cffee62cd6f3193580e4e0950d0a3a1fbf6611df42474a511d30065f41cbdbaaf4360a6c61719b7d3f10692efac762d1a80f6311d42eb12a
SSDEEP

1536:vB5uVw89wt2v7Fz9fyOjAEx93MDbT0f5aX2:v++tov7Fz9fyOjOQxK2

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

modern-educators.gl.at.ply.gg:23695

Mutex

lu0xD4CO1T8ycPIn

Attributes

Install_directory
%Userprofile%
install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/3016-1-0x00000000010B0000-0x0000000001100000-memory.dmp family_xworm
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

resource	yara_rule
behavioral1/memory/3016-1-0x00000000010B0000-0x0000000001100000-memory.dmp	family_xworm

Drops startup file 2 IoCs

Processes:

Image logger beta.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows startup backup.lnk	Image logger beta.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows startup backup.lnk	Image logger beta.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Image logger beta.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows startup backup = "C:\\Users\\Admin\\Windows startup backup"	Image logger beta.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Image logger beta.exe

description pid process

Token: SeDebugPrivilege 3016 Image logger beta.exe
Token: SeDebugPrivilege 3016 Image logger beta.exe

flow	ioc
4	ip-api.com

description	pid	process
Token: SeDebugPrivilege	3016	Image logger beta.exe
Token: SeDebugPrivilege	3016	Image logger beta.exe

C:\Users\Admin\AppData\Local\Temp\Image logger beta.exe
"C:\Users\Admin\AppData\Local\Temp\Image logger beta.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:3016

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3016-0-0x000007FEF5343000-0x000007FEF5344000-memory.dmp

Filesize
4KB

Download
memory/3016-1-0x00000000010B0000-0x0000000001100000-memory.dmp

Filesize
320KB

Download
memory/3016-2-0x000007FEF5340000-0x000007FEF5D2C000-memory.dmp

Filesize
9.9MB

Download
memory/3016-6-0x000007FEF5343000-0x000007FEF5344000-memory.dmp

Filesize
4KB

Download
memory/3016-7-0x000007FEF5340000-0x000007FEF5D2C000-memory.dmp

Filesize
9.9MB

Download