xworm | a5728f8fd33c77818782d3eef567b77d1586b1927696affced63d494691edbe6

Analysis

max time kernel
350s
max time network
351s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 21:51

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

sv.exe
Size

63KB
MD5

c095a62b525e62244cad230e696028cf
SHA1

67232c186d3efe248b540f1f2fe3382770b5074a
SHA256

a5728f8fd33c77818782d3eef567b77d1586b1927696affced63d494691edbe6
SHA512

5ba859d89a9277d9b6243f461991cc6472d001cdea52d9fcfba3cbead88fbc69d9dfce076b1fdeaf0d1cd21fe4cace54f1cefe1c352d70cc8fa2898fe1b61fb0
SSDEEP

1536:unjFXblMp3wgDkbivVSm16KTOKjLIJXc:unrAwgDkbicmbOKj0JM

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

amount-acceptance.gl.at.ply.gg:7420

Attributes

Install_directory
%ProgramData%
install_file
svhost.exe

Signatures

Detect Xworm Payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1800-1-0x0000000000EA0000-0x0000000000EB6000-memory.dmp	family_xworm
C:\ProgramData\svhost.exe	family_xworm
behavioral2/memory/1724-34-0x0000000000970000-0x0000000000986000-memory.dmp	family_xworm
behavioral2/memory/2076-39-0x0000000000D20000-0x0000000000D36000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

2672 powershell.exe
2096 powershell.exe
2552 powershell.exe
3016 powershell.exe

pid	process
2672	powershell.exe
2096	powershell.exe
2552	powershell.exe
3016	powershell.exe

Drops startup file 2 IoCs

Processes:

sv.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk	sv.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk	sv.exe

Executes dropped EXE 6 IoCs

Processes:

svhost.exesvhost.exesvhost.exesvhost.exesvhost.exesvhost.exe

pid process

1724 svhost.exe
2076 svhost.exe
1140 svhost.exe
1692 svhost.exe
2500 svhost.exe
1796 svhost.exe
Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Processes:

sv.exe

description ioc process

Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\ProgramData\\svhost.exe" sv.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2972 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

2096 powershell.exe
2552 powershell.exe
3016 powershell.exe
2672 powershell.exe

pid	process
1724	svhost.exe
2076	svhost.exe
1140	svhost.exe
1692	svhost.exe
2500	svhost.exe
1796	svhost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\ProgramData\\svhost.exe"	sv.exe

pid	process
2972	schtasks.exe

pid	process
2096	powershell.exe
2552	powershell.exe
3016	powershell.exe
2672	powershell.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

sv.exepowershell.exepowershell.exepowershell.exepowershell.exesvhost.exesvhost.exesvhost.exesvhost.exesvhost.exesvhost.exeshutdown.exe

description	pid	process
Token: SeDebugPrivilege	1800	sv.exe
Token: SeDebugPrivilege	2096	powershell.exe
Token: SeDebugPrivilege	2552	powershell.exe
Token: SeDebugPrivilege	3016	powershell.exe
Token: SeDebugPrivilege	2672	powershell.exe
Token: SeDebugPrivilege	1800	sv.exe
Token: SeDebugPrivilege	1724	svhost.exe
Token: SeDebugPrivilege	2076	svhost.exe
Token: SeDebugPrivilege	1140	svhost.exe
Token: SeDebugPrivilege	1692	svhost.exe
Token: SeDebugPrivilege	2500	svhost.exe
Token: SeDebugPrivilege	1796	svhost.exe
Token: SeShutdownPrivilege	620	shutdown.exe
Token: SeRemoteShutdownPrivilege	620	shutdown.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

sv.exe

pid process

1800 sv.exe

pid	process
1800	sv.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

sv.exetaskeng.exe

description	pid	process	target process
PID 1800 wrote to memory of 2096	1800	sv.exe	powershell.exe
PID 1800 wrote to memory of 2096	1800	sv.exe	powershell.exe
PID 1800 wrote to memory of 2096	1800	sv.exe	powershell.exe
PID 1800 wrote to memory of 2552	1800	sv.exe	powershell.exe
PID 1800 wrote to memory of 2552	1800	sv.exe	powershell.exe
PID 1800 wrote to memory of 2552	1800	sv.exe	powershell.exe
PID 1800 wrote to memory of 3016	1800	sv.exe	powershell.exe
PID 1800 wrote to memory of 3016	1800	sv.exe	powershell.exe
PID 1800 wrote to memory of 3016	1800	sv.exe	powershell.exe
PID 1800 wrote to memory of 2672	1800	sv.exe	powershell.exe
PID 1800 wrote to memory of 2672	1800	sv.exe	powershell.exe
PID 1800 wrote to memory of 2672	1800	sv.exe	powershell.exe
PID 1800 wrote to memory of 2972	1800	sv.exe	schtasks.exe
PID 1800 wrote to memory of 2972	1800	sv.exe	schtasks.exe
PID 1800 wrote to memory of 2972	1800	sv.exe	schtasks.exe
PID 2756 wrote to memory of 1724	2756	taskeng.exe	svhost.exe
PID 2756 wrote to memory of 1724	2756	taskeng.exe	svhost.exe
PID 2756 wrote to memory of 1724	2756	taskeng.exe	svhost.exe
PID 2756 wrote to memory of 2076	2756	taskeng.exe	svhost.exe
PID 2756 wrote to memory of 2076	2756	taskeng.exe	svhost.exe
PID 2756 wrote to memory of 2076	2756	taskeng.exe	svhost.exe
PID 2756 wrote to memory of 1140	2756	taskeng.exe	svhost.exe
PID 2756 wrote to memory of 1140	2756	taskeng.exe	svhost.exe
PID 2756 wrote to memory of 1140	2756	taskeng.exe	svhost.exe
PID 2756 wrote to memory of 1692	2756	taskeng.exe	svhost.exe
PID 2756 wrote to memory of 1692	2756	taskeng.exe	svhost.exe
PID 2756 wrote to memory of 1692	2756	taskeng.exe	svhost.exe
PID 2756 wrote to memory of 2500	2756	taskeng.exe	svhost.exe
PID 2756 wrote to memory of 2500	2756	taskeng.exe	svhost.exe
PID 2756 wrote to memory of 2500	2756	taskeng.exe	svhost.exe
PID 2756 wrote to memory of 1796	2756	taskeng.exe	svhost.exe
PID 2756 wrote to memory of 1796	2756	taskeng.exe	svhost.exe
PID 2756 wrote to memory of 1796	2756	taskeng.exe	svhost.exe
PID 1800 wrote to memory of 620	1800	sv.exe	shutdown.exe
PID 1800 wrote to memory of 620	1800	sv.exe	shutdown.exe
PID 1800 wrote to memory of 620	1800	sv.exe	shutdown.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\sv.exe
"C:\Users\Admin\AppData\Local\Temp\sv.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1800

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sv.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2096

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sv.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2552

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svhost.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3016

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2672

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svhost" /tr "C:\ProgramData\svhost.exe"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\shutdown.exe
shutdown.exe /f /s /t 0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:620

C:\Windows\system32\taskeng.exe
taskeng.exe {3605DFBA-6E00-411A-B280-163A2FDBD5D7} S-1-5-21-1298544033-3225604241-2703760938-1000:IZKCKOTP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2756

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1724

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2076

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1140

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1692

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2500

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1796

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1672

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2688

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\svhost.exe
Filesize
63KB

MD5
c095a62b525e62244cad230e696028cf

SHA1
67232c186d3efe248b540f1f2fe3382770b5074a

SHA256
a5728f8fd33c77818782d3eef567b77d1586b1927696affced63d494691edbe6

SHA512
5ba859d89a9277d9b6243f461991cc6472d001cdea52d9fcfba3cbead88fbc69d9dfce076b1fdeaf0d1cd21fe4cace54f1cefe1c352d70cc8fa2898fe1b61fb0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
963a18a3b59cbf5d3e23ff1dca26d5b8

SHA1
bf2124b0ccea02889bfb10c5470c6bf75dcc08de

SHA256
a21381b592d80875cef51d2bd74b0c0041b512e90c1fc9f1c7c833b8bd6e3009

SHA512
068d19fd68d63675c5a9fe35f1695bea2c1ee2427611e03234f48ad9b813349d5a3e0528d481597fc8c21b36baad874c004803bf1df8a46d9fe864f3e8f50edc

Download Submit
memory/1724-34-0x0000000000970000-0x0000000000986000-memory.dmp

Filesize
88KB

Download
memory/1800-1-0x0000000000EA0000-0x0000000000EB6000-memory.dmp

Filesize
88KB

Download
memory/1800-41-0x0000000000B90000-0x0000000000B9A000-memory.dmp

Filesize
40KB

Download
memory/1800-0-0x000007FEF5873000-0x000007FEF5874000-memory.dmp

Filesize
4KB

Download
memory/1800-36-0x000000001B2C0000-0x000000001B340000-memory.dmp

Filesize
512KB

Download
memory/1800-35-0x000007FEF5873000-0x000007FEF5874000-memory.dmp

Filesize
4KB

Download
memory/1800-30-0x000000001B2C0000-0x000000001B340000-memory.dmp

Filesize
512KB

Download
memory/2076-39-0x0000000000D20000-0x0000000000D36000-memory.dmp

Filesize
88KB

Download
memory/2096-7-0x000000001B700000-0x000000001B9E2000-memory.dmp

Filesize
2.9MB

Download
memory/2096-8-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download
memory/2096-6-0x0000000002840000-0x00000000028C0000-memory.dmp

Filesize
512KB

Download
memory/2552-15-0x0000000000550000-0x0000000000558000-memory.dmp

Filesize
32KB

Download
memory/2552-14-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads