xworm | a5728f8fd33c77818782d3eef567b77d1586b1927696affced63d494691edbe6

Analysis

max time kernel
146s
max time network
149s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sv.exe
Size

63KB
MD5

c095a62b525e62244cad230e696028cf
SHA1

67232c186d3efe248b540f1f2fe3382770b5074a
SHA256

a5728f8fd33c77818782d3eef567b77d1586b1927696affced63d494691edbe6
SHA512

5ba859d89a9277d9b6243f461991cc6472d001cdea52d9fcfba3cbead88fbc69d9dfce076b1fdeaf0d1cd21fe4cace54f1cefe1c352d70cc8fa2898fe1b61fb0
SSDEEP

1536:unjFXblMp3wgDkbivVSm16KTOKjLIJXc:unrAwgDkbicmbOKj0JM

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

amount-acceptance.gl.at.ply.gg:7420

Attributes

Install_directory
%ProgramData%
install_file
svhost.exe

Signatures

Detect Xworm Payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2072-1-0x00000000008C0000-0x00000000008D6000-memory.dmp	family_xworm
C:\ProgramData\svhost.exe	family_xworm
behavioral2/memory/1712-39-0x0000000000A40000-0x0000000000A56000-memory.dmp	family_xworm
behavioral2/memory/1560-41-0x0000000000EB0000-0x0000000000EC6000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

2820 powershell.exe
2740 powershell.exe
2816 powershell.exe
2064 powershell.exe

pid	process
2820	powershell.exe
2740	powershell.exe
2816	powershell.exe
2064	powershell.exe

Drops startup file 2 IoCs

Processes:

sv.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk	sv.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk	sv.exe

Executes dropped EXE 2 IoCs

Processes:

svhost.exesvhost.exe

pid process

1712 svhost.exe
1560 svhost.exe
Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Processes:

sv.exe

description ioc process

Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\ProgramData\\svhost.exe" sv.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2580 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

2064 powershell.exe
2820 powershell.exe
2740 powershell.exe
2816 powershell.exe

pid	process
1712	svhost.exe
1560	svhost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\ProgramData\\svhost.exe"	sv.exe

pid	process
2580	schtasks.exe

pid	process
2064	powershell.exe
2820	powershell.exe
2740	powershell.exe
2816	powershell.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

sv.exepowershell.exepowershell.exepowershell.exepowershell.exesvhost.exesvhost.exe

description	pid	process
Token: SeDebugPrivilege	2072	sv.exe
Token: SeDebugPrivilege	2064	powershell.exe
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeDebugPrivilege	2740	powershell.exe
Token: SeDebugPrivilege	2816	powershell.exe
Token: SeDebugPrivilege	2072	sv.exe
Token: SeDebugPrivilege	1712	svhost.exe
Token: SeDebugPrivilege	1560	svhost.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

sv.exetaskeng.exe

description	pid	process	target process
PID 2072 wrote to memory of 2064	2072	sv.exe	powershell.exe
PID 2072 wrote to memory of 2064	2072	sv.exe	powershell.exe
PID 2072 wrote to memory of 2064	2072	sv.exe	powershell.exe
PID 2072 wrote to memory of 2820	2072	sv.exe	powershell.exe
PID 2072 wrote to memory of 2820	2072	sv.exe	powershell.exe
PID 2072 wrote to memory of 2820	2072	sv.exe	powershell.exe
PID 2072 wrote to memory of 2740	2072	sv.exe	powershell.exe
PID 2072 wrote to memory of 2740	2072	sv.exe	powershell.exe
PID 2072 wrote to memory of 2740	2072	sv.exe	powershell.exe
PID 2072 wrote to memory of 2816	2072	sv.exe	powershell.exe
PID 2072 wrote to memory of 2816	2072	sv.exe	powershell.exe
PID 2072 wrote to memory of 2816	2072	sv.exe	powershell.exe
PID 2072 wrote to memory of 2580	2072	sv.exe	schtasks.exe
PID 2072 wrote to memory of 2580	2072	sv.exe	schtasks.exe
PID 2072 wrote to memory of 2580	2072	sv.exe	schtasks.exe
PID 2624 wrote to memory of 1712	2624	taskeng.exe	svhost.exe
PID 2624 wrote to memory of 1712	2624	taskeng.exe	svhost.exe
PID 2624 wrote to memory of 1712	2624	taskeng.exe	svhost.exe
PID 2624 wrote to memory of 1560	2624	taskeng.exe	svhost.exe
PID 2624 wrote to memory of 1560	2624	taskeng.exe	svhost.exe
PID 2624 wrote to memory of 1560	2624	taskeng.exe	svhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\sv.exe
"C:\Users\Admin\AppData\Local\Temp\sv.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2072

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sv.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2064

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sv.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2820

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svhost.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2740

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2816

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svhost" /tr "C:\ProgramData\svhost.exe"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2580

C:\Windows\system32\taskeng.exe
taskeng.exe {83D9DEEF-E90B-4E0F-ACB1-CD3073ECAD39} S-1-5-21-1340930862-1405011213-2821322012-1000:TICCAUTD\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2624

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1712

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1560

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\svhost.exe
Filesize
63KB

MD5
c095a62b525e62244cad230e696028cf

SHA1
67232c186d3efe248b540f1f2fe3382770b5074a

SHA256
a5728f8fd33c77818782d3eef567b77d1586b1927696affced63d494691edbe6

SHA512
5ba859d89a9277d9b6243f461991cc6472d001cdea52d9fcfba3cbead88fbc69d9dfce076b1fdeaf0d1cd21fe4cace54f1cefe1c352d70cc8fa2898fe1b61fb0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
04a3fad150c51bff2260617c641f6303

SHA1
58e177b189d22aeea608532750b60e4ab879a18b

SHA256
22b28a6517330f1614514fc958897dd733031b4f9a66ef8959b8cf832aa9a355

SHA512
b81a80ac3962e8012b49631b0ac3481ac5b2c5f299e1bd4ef81efd97eeac32fc5886b83a7d8382c9884957eec924041b792fd0b33dd8c2995b7fe8f4fb85ac43

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1560-41-0x0000000000EB0000-0x0000000000EC6000-memory.dmp

Filesize
88KB

Download
memory/1712-39-0x0000000000A40000-0x0000000000A56000-memory.dmp

Filesize
88KB

Download
memory/2064-6-0x0000000002900000-0x0000000002980000-memory.dmp

Filesize
512KB

Download
memory/2064-7-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Filesize
2.9MB

Download
memory/2064-8-0x00000000022C0000-0x00000000022C8000-memory.dmp

Filesize
32KB

Download
memory/2072-32-0x000000001B000000-0x000000001B080000-memory.dmp

Filesize
512KB

Download
memory/2072-0-0x000007FEF55A3000-0x000007FEF55A4000-memory.dmp

Filesize
4KB

Download
memory/2072-33-0x000007FEF55A3000-0x000007FEF55A4000-memory.dmp

Filesize
4KB

Download
memory/2072-34-0x000000001B000000-0x000000001B080000-memory.dmp

Filesize
512KB

Download
memory/2072-1-0x00000000008C0000-0x00000000008D6000-memory.dmp

Filesize
88KB

Download
memory/2820-15-0x0000000002070000-0x0000000002078000-memory.dmp

Filesize
32KB

Download
memory/2820-14-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

Filesize
2.9MB

Download