xworm | a5728f8fd33c77818782d3eef567b77d1586b1927696affced63d494691edbe6

Analysis

max time kernel
345s
max time network
348s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
30-06-2024 21:53

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

sv.exe
Size

63KB
MD5

c095a62b525e62244cad230e696028cf
SHA1

67232c186d3efe248b540f1f2fe3382770b5074a
SHA256

a5728f8fd33c77818782d3eef567b77d1586b1927696affced63d494691edbe6
SHA512

5ba859d89a9277d9b6243f461991cc6472d001cdea52d9fcfba3cbead88fbc69d9dfce076b1fdeaf0d1cd21fe4cace54f1cefe1c352d70cc8fa2898fe1b61fb0
SSDEEP

1536:unjFXblMp3wgDkbivVSm16KTOKjLIJXc:unrAwgDkbicmbOKj0JM

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

amount-acceptance.gl.at.ply.gg:7420

Attributes

Install_directory
%ProgramData%
install_file
svhost.exe

Signatures

Detect Xworm Payload 2 IoCs

Processes:

resource yara_rule

behavioral1/memory/5036-1-0x0000000000AC0000-0x0000000000AD6000-memory.dmp family_xworm
C:\ProgramData\svhost.exe family_xworm
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

4236 powershell.exe
3316 powershell.exe
4844 powershell.exe
1740 powershell.exe

resource	yara_rule
behavioral1/memory/5036-1-0x0000000000AC0000-0x0000000000AD6000-memory.dmp	family_xworm
C:\ProgramData\svhost.exe	family_xworm

Drops startup file 2 IoCs

Processes:

sv.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk	sv.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk	sv.exe

Executes dropped EXE 5 IoCs

Processes:

svhost.exesvhost.exesvhost.exesvhost.exesvhost.exe

pid process

168 svhost.exe
4896 svhost.exe
2104 svhost.exe
3024 svhost.exe
4892 svhost.exe
Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Processes:

sv.exe

description ioc process

Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\ProgramData\\svhost.exe" sv.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
168	svhost.exe
4896	svhost.exe
2104	svhost.exe
3024	svhost.exe
4892	svhost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\ProgramData\\svhost.exe"	sv.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

208 schtasks.exe

pid	process
208	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid	process
4236	powershell.exe
4236	powershell.exe
4236	powershell.exe
3316	powershell.exe
3316	powershell.exe
3316	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
1740	powershell.exe
1740	powershell.exe
1740	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

sv.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	5036	sv.exe
Token: SeDebugPrivilege	4236	powershell.exe
Token: SeIncreaseQuotaPrivilege	4236	powershell.exe
Token: SeSecurityPrivilege	4236	powershell.exe
Token: SeTakeOwnershipPrivilege	4236	powershell.exe
Token: SeLoadDriverPrivilege	4236	powershell.exe
Token: SeSystemProfilePrivilege	4236	powershell.exe
Token: SeSystemtimePrivilege	4236	powershell.exe
Token: SeProfSingleProcessPrivilege	4236	powershell.exe
Token: SeIncBasePriorityPrivilege	4236	powershell.exe
Token: SeCreatePagefilePrivilege	4236	powershell.exe
Token: SeBackupPrivilege	4236	powershell.exe
Token: SeRestorePrivilege	4236	powershell.exe
Token: SeShutdownPrivilege	4236	powershell.exe
Token: SeDebugPrivilege	4236	powershell.exe
Token: SeSystemEnvironmentPrivilege	4236	powershell.exe
Token: SeRemoteShutdownPrivilege	4236	powershell.exe
Token: SeUndockPrivilege	4236	powershell.exe
Token: SeManageVolumePrivilege	4236	powershell.exe
Token: 33	4236	powershell.exe
Token: 34	4236	powershell.exe
Token: 35	4236	powershell.exe
Token: 36	4236	powershell.exe
Token: SeDebugPrivilege	3316	powershell.exe
Token: SeIncreaseQuotaPrivilege	3316	powershell.exe
Token: SeSecurityPrivilege	3316	powershell.exe
Token: SeTakeOwnershipPrivilege	3316	powershell.exe
Token: SeLoadDriverPrivilege	3316	powershell.exe
Token: SeSystemProfilePrivilege	3316	powershell.exe
Token: SeSystemtimePrivilege	3316	powershell.exe
Token: SeProfSingleProcessPrivilege	3316	powershell.exe
Token: SeIncBasePriorityPrivilege	3316	powershell.exe
Token: SeCreatePagefilePrivilege	3316	powershell.exe
Token: SeBackupPrivilege	3316	powershell.exe
Token: SeRestorePrivilege	3316	powershell.exe
Token: SeShutdownPrivilege	3316	powershell.exe
Token: SeDebugPrivilege	3316	powershell.exe
Token: SeSystemEnvironmentPrivilege	3316	powershell.exe
Token: SeRemoteShutdownPrivilege	3316	powershell.exe
Token: SeUndockPrivilege	3316	powershell.exe
Token: SeManageVolumePrivilege	3316	powershell.exe
Token: 33	3316	powershell.exe
Token: 34	3316	powershell.exe
Token: 35	3316	powershell.exe
Token: 36	3316	powershell.exe
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeIncreaseQuotaPrivilege	4844	powershell.exe
Token: SeSecurityPrivilege	4844	powershell.exe
Token: SeTakeOwnershipPrivilege	4844	powershell.exe
Token: SeLoadDriverPrivilege	4844	powershell.exe
Token: SeSystemProfilePrivilege	4844	powershell.exe
Token: SeSystemtimePrivilege	4844	powershell.exe
Token: SeProfSingleProcessPrivilege	4844	powershell.exe
Token: SeIncBasePriorityPrivilege	4844	powershell.exe
Token: SeCreatePagefilePrivilege	4844	powershell.exe
Token: SeBackupPrivilege	4844	powershell.exe
Token: SeRestorePrivilege	4844	powershell.exe
Token: SeShutdownPrivilege	4844	powershell.exe
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeSystemEnvironmentPrivilege	4844	powershell.exe
Token: SeRemoteShutdownPrivilege	4844	powershell.exe
Token: SeUndockPrivilege	4844	powershell.exe
Token: SeManageVolumePrivilege	4844	powershell.exe
Token: 33	4844	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

sv.exe

pid process

5036 sv.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

5092 LogonUI.exe

pid	process
5036	sv.exe

pid	process
5092	LogonUI.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

sv.exe

description	pid	process	target process
PID 5036 wrote to memory of 4236	5036	sv.exe	powershell.exe
PID 5036 wrote to memory of 4236	5036	sv.exe	powershell.exe
PID 5036 wrote to memory of 3316	5036	sv.exe	powershell.exe
PID 5036 wrote to memory of 3316	5036	sv.exe	powershell.exe
PID 5036 wrote to memory of 4844	5036	sv.exe	powershell.exe
PID 5036 wrote to memory of 4844	5036	sv.exe	powershell.exe
PID 5036 wrote to memory of 1740	5036	sv.exe	powershell.exe
PID 5036 wrote to memory of 1740	5036	sv.exe	powershell.exe
PID 5036 wrote to memory of 208	5036	sv.exe	schtasks.exe
PID 5036 wrote to memory of 208	5036	sv.exe	schtasks.exe
PID 5036 wrote to memory of 404	5036	sv.exe	shutdown.exe
PID 5036 wrote to memory of 404	5036	sv.exe	shutdown.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\sv.exe
"C:\Users\Admin\AppData\Local\Temp\sv.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5036

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sv.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4236

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sv.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3316

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svhost.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4844

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1740

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svhost" /tr "C:\ProgramData\svhost.exe"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:208

C:\Windows\SYSTEM32\shutdown.exe
shutdown.exe /f /s /t 0
2⤵
PID:404

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:168

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:4896

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:2104

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:3024

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:4892

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3ae5055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5092

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\svhost.exe
Filesize
63KB

MD5
c095a62b525e62244cad230e696028cf

SHA1
67232c186d3efe248b540f1f2fe3382770b5074a

SHA256
a5728f8fd33c77818782d3eef567b77d1586b1927696affced63d494691edbe6

SHA512
5ba859d89a9277d9b6243f461991cc6472d001cdea52d9fcfba3cbead88fbc69d9dfce076b1fdeaf0d1cd21fe4cace54f1cefe1c352d70cc8fa2898fe1b61fb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svhost.exe.log
Filesize
654B

MD5
16c5fce5f7230eea11598ec11ed42862

SHA1
75392d4824706090f5e8907eee1059349c927600

SHA256
87ba77c13905298acbac72be90949c4fe0755b6eff9777615aa37f252515f151

SHA512
153edd6da59beea6cc411ed7383c32916425d6ebb65f04c65aab7c1d6b25443d143aa8449aa92149de0ad8a975f6ecaa60f9f7574536eec6b38fe5fd3a6c6adc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
a7d53514906a1105baf27d3bf52fb059

SHA1
af129da6fc4826ef2ca729bc48e18a6759489cbb

SHA256
6c4dad46efd4d773cffa7de25deca7881800ca5f7a959ee665001742abe5f12c

SHA512
1aea6010174e105eda6c325fe28eb07962b363776b9111ca879eac587a0a4d035c39169d2676f859b74d8581ca4c5c0a44fbe4afcdda49ae3fb9829f115b3ebc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
29cab0be6ed68f483bd9c6c938ed6823

SHA1
939a89e650a625f202196b1c28901dbe2b05f97a

SHA256
31da0740a88332eba42a3fb8095eb41a199e6f27108c01c68c9e2a27a58ac31d

SHA512
e830593a7a1e8cbb502405550f8b0a185d66f38b7a1f92dba6e85afdf469d04923f72d39692e298ee8c5b11cd0ed2fa52b82cf484ebf98c8cc6df19828225bf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
f4cebace363955b5fb79b606d1252b9e

SHA1
f57eb08ca60074896c6d65c98e2f8b99450f7aee

SHA256
ba0bf3227005c611f8d0d8ad6c73089c086e94019641f0fc14a303c760b6928a

SHA512
5d63af7b9754546535b86504494ffc6eb0ad79653f148ce4a2e9199badbdf582fac30c31dfeecf79b9d67b21b779d5e4132da8884e1d365c1ca380c719f1a52f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sxkcg4tk.qfj.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
memory/4236-52-0x00007FFDC0CF0000-0x00007FFDC16DC000-memory.dmp

Filesize
9.9MB

Download
memory/4236-9-0x00007FFDC0CF0000-0x00007FFDC16DC000-memory.dmp

Filesize
9.9MB

Download
memory/4236-48-0x00007FFDC0CF0000-0x00007FFDC16DC000-memory.dmp

Filesize
9.9MB

Download
memory/4236-6-0x0000019E45600000-0x0000019E45622000-memory.dmp

Filesize
136KB

Download
memory/4236-20-0x00007FFDC0CF0000-0x00007FFDC16DC000-memory.dmp

Filesize
9.9MB

Download
memory/4236-11-0x00007FFDC0CF0000-0x00007FFDC16DC000-memory.dmp

Filesize
9.9MB

Download
memory/4236-10-0x0000019E457B0000-0x0000019E45826000-memory.dmp

Filesize
472KB

Download
memory/4236-41-0x00007FFDC0CF0000-0x00007FFDC16DC000-memory.dmp

Filesize
9.9MB

Download
memory/5036-187-0x00007FFDC0CF0000-0x00007FFDC16DC000-memory.dmp

Filesize
9.9MB

Download
memory/5036-188-0x00007FFDC0CF0000-0x00007FFDC16DC000-memory.dmp

Filesize
9.9MB

Download
memory/5036-0-0x00007FFDC0CF3000-0x00007FFDC0CF4000-memory.dmp

Filesize
4KB

Download
memory/5036-1-0x0000000000AC0000-0x0000000000AD6000-memory.dmp

Filesize
88KB

Download
memory/5036-195-0x00000000012F0000-0x00000000012FA000-memory.dmp

Filesize
40KB

Download
memory/5036-199-0x00007FFDC0CF0000-0x00007FFDC16DC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads