xworm | 8f619c4d07c848855b27863e887f95f7307ae2d46f64c661ca17a2d96798a2af

Analysis

max time kernel
148s
max time network
144s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dll (1).exe
Size

1.8MB
MD5

2d8725f268c90475c94941e550019cf9
SHA1

c51ed1a97e71cbdfb7712f7fbe2251553f1054b7
SHA256

8f619c4d07c848855b27863e887f95f7307ae2d46f64c661ca17a2d96798a2af
SHA512

4998e8bf9e33f31e895783e31185fd678c368e3eb3b524b65ff1d988f0395cdd8d7a1aa6776d89b1f284656f2e6c97b848d8e909c167b52932a1d83382e57bb1
SSDEEP

49152:d78cpUcrJCoHjuFnBPn20DRt8HcWynnBvIyn+inbT:d78cpUcrJC2q9BPjo8WyBv1n+in

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

127.0.0.1:35472

haxxy999-35472.portmap.host:35472

Attributes

Install_directory
%Temp%
install_file
svchost.exe

Signatures

Detect Xworm Payload 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\Feather new.exe	family_xworm
behavioral1/memory/2160-13-0x0000000000B30000-0x0000000000B4C000-memory.dmp	family_xworm
behavioral1/memory/1688-55-0x0000000000EF0000-0x0000000000F0C000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

2752 powershell.exe
1748 powershell.exe
1208 powershell.exe
620 powershell.exe

Drops startup file 2 IoCs

Processes:

Feather new.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	Feather new.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	Feather new.exe

Executes dropped EXE 4 IoCs

Processes:

WaveInstaller.exeFeather new.exesvchost.exesvchost.exe

pid process

2888 WaveInstaller.exe
2160 Feather new.exe
1688 svchost.exe
3060 svchost.exe

pid	process
2888	WaveInstaller.exe
2160	Feather new.exe
1688	svchost.exe
3060	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Feather new.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe"	Feather new.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2232 schtasks.exe

flow	ioc
4	ip-api.com

pid	process
2232	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeFeather new.exe

pid	process
2752	powershell.exe
1748	powershell.exe
1208	powershell.exe
620	powershell.exe
2160	Feather new.exe
2160	Feather new.exe
2160	Feather new.exe
2160	Feather new.exe
2160	Feather new.exe
2160	Feather new.exe
2160	Feather new.exe
2160	Feather new.exe
2160	Feather new.exe
2160	Feather new.exe
2160	Feather new.exe
2160	Feather new.exe
2160	Feather new.exe
2160	Feather new.exe
2160	Feather new.exe
2160	Feather new.exe
2160	Feather new.exe
2160	Feather new.exe
2160	Feather new.exe
2160	Feather new.exe
2160	Feather new.exe
2160	Feather new.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

Feather new.exepowershell.exepowershell.exepowershell.exepowershell.exesvchost.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	2160	Feather new.exe
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeDebugPrivilege	1748	powershell.exe
Token: SeDebugPrivilege	1208	powershell.exe
Token: SeDebugPrivilege	620	powershell.exe
Token: SeDebugPrivilege	2160	Feather new.exe
Token: SeDebugPrivilege	1688	svchost.exe
Token: SeDebugPrivilege	3060	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Feather new.exe

pid process

2160 Feather new.exe

pid	process
2160	Feather new.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

dll (1).exeFeather new.exetaskeng.exe

description	pid	process	target process
PID 2180 wrote to memory of 2888	2180	dll (1).exe	WaveInstaller.exe
PID 2180 wrote to memory of 2888	2180	dll (1).exe	WaveInstaller.exe
PID 2180 wrote to memory of 2888	2180	dll (1).exe	WaveInstaller.exe
PID 2180 wrote to memory of 2888	2180	dll (1).exe	WaveInstaller.exe
PID 2180 wrote to memory of 2888	2180	dll (1).exe	WaveInstaller.exe
PID 2180 wrote to memory of 2888	2180	dll (1).exe	WaveInstaller.exe
PID 2180 wrote to memory of 2888	2180	dll (1).exe	WaveInstaller.exe
PID 2180 wrote to memory of 2160	2180	dll (1).exe	Feather new.exe
PID 2180 wrote to memory of 2160	2180	dll (1).exe	Feather new.exe
PID 2180 wrote to memory of 2160	2180	dll (1).exe	Feather new.exe
PID 2160 wrote to memory of 2752	2160	Feather new.exe	powershell.exe
PID 2160 wrote to memory of 2752	2160	Feather new.exe	powershell.exe
PID 2160 wrote to memory of 2752	2160	Feather new.exe	powershell.exe
PID 2160 wrote to memory of 1748	2160	Feather new.exe	powershell.exe
PID 2160 wrote to memory of 1748	2160	Feather new.exe	powershell.exe
PID 2160 wrote to memory of 1748	2160	Feather new.exe	powershell.exe
PID 2160 wrote to memory of 1208	2160	Feather new.exe	powershell.exe
PID 2160 wrote to memory of 1208	2160	Feather new.exe	powershell.exe
PID 2160 wrote to memory of 1208	2160	Feather new.exe	powershell.exe
PID 2160 wrote to memory of 620	2160	Feather new.exe	powershell.exe
PID 2160 wrote to memory of 620	2160	Feather new.exe	powershell.exe
PID 2160 wrote to memory of 620	2160	Feather new.exe	powershell.exe
PID 2160 wrote to memory of 2232	2160	Feather new.exe	schtasks.exe
PID 2160 wrote to memory of 2232	2160	Feather new.exe	schtasks.exe
PID 2160 wrote to memory of 2232	2160	Feather new.exe	schtasks.exe
PID 1856 wrote to memory of 1688	1856	taskeng.exe	svchost.exe
PID 1856 wrote to memory of 1688	1856	taskeng.exe	svchost.exe
PID 1856 wrote to memory of 1688	1856	taskeng.exe	svchost.exe
PID 1856 wrote to memory of 3060	1856	taskeng.exe	svchost.exe
PID 1856 wrote to memory of 3060	1856	taskeng.exe	svchost.exe
PID 1856 wrote to memory of 3060	1856	taskeng.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\dll (1).exe
"C:\Users\Admin\AppData\Local\Temp\dll (1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180

C:\Users\Admin\WaveInstaller.exe
"C:\Users\Admin\WaveInstaller.exe"
2⤵
- Executes dropped EXE
PID:2888

C:\Users\Admin\Feather new.exe
"C:\Users\Admin\Feather new.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Feather new.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2752

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Feather new.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1748

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1208

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:620

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2232

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2720

C:\Windows\system32\taskeng.exe
taskeng.exe {B191982F-505B-4B33-A9BF-9AB8C60BF541} S-1-5-21-2737914667-933161113-3798636211-1000:PUMARTNR\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1856

C:\Users\Admin\AppData\Local\Temp\svchost.exe
C:\Users\Admin\AppData\Local\Temp\svchost.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1688

C:\Users\Admin\AppData\Local\Temp\svchost.exe
C:\Users\Admin\AppData\Local\Temp\svchost.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3060

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\B5C4N50F5MESN2BALBN5.temp
Filesize
7KB

MD5
dd553cff0acb7849b3b4b9560a2c776a

SHA1
6812ed4532001f4c59958457ba3619ad40614d72

SHA256
2721f8684e130334788aa32ee47244e8096f5cee244e24a9a055f02c0b43a660

SHA512
86adc82fda8906df274de430916752877c8f0e8e0621f569c7aa5cc12653199211b7bacf52c2ea12bddffcaf61be4335c8bba76d3a4b61a0d52a4098e485b3c7

Download Submit
C:\Users\Admin\Feather new.exe
Filesize
87KB

MD5
d937a01ea0bd6d64bf218bf9f052601d

SHA1
e47417cb8773b13c66717cc3137bda4f919578b2

SHA256
8d2252827e127ba22c6645d57981a0556149255ec6b430582c02d9e6b8cb2adb

SHA512
b1d73cf9377f1dcb774bce9840fafe950e44ab3d39763c2a12c918fb8a0a8de463a24b127388b59dae5fedd1147387ee9b1d0d1fcc0451d16094495f8703c0cd

Download Submit
C:\Users\Admin\WaveInstaller.exe
Filesize
1.5MB

MD5
b075f4320e46d0d5e78a649e8ee011cc

SHA1
b0dd50171323f0f83dbea0340e9ed8cf44bea38e

SHA256
8581823244a50bbed9709d09f3eba29dd9989681d96bff2b6c19245053069feb

SHA512
e08024b5fa50dc344ca18413a6c21e0f20490c22c90c565d6f663014f1673643da1d5d748e0cefca8a7cbae91a62470289803ad588d3aa5cf3dc6292d7393d47

Download Submit
memory/1688-55-0x0000000000EF0000-0x0000000000F0C000-memory.dmp

Filesize
112KB

Download
memory/1748-30-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

Filesize
32KB

Download
memory/1748-29-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/2160-13-0x0000000000B30000-0x0000000000B4C000-memory.dmp

Filesize
112KB

Download
memory/2160-15-0x000007FEF5780000-0x000007FEF616C000-memory.dmp

Filesize
9.9MB

Download
memory/2160-41-0x000007FEF5780000-0x000007FEF616C000-memory.dmp

Filesize
9.9MB

Download
memory/2180-0-0x000007FEF5783000-0x000007FEF5784000-memory.dmp

Filesize
4KB

Download
memory/2180-1-0x0000000000B50000-0x0000000000D2E000-memory.dmp

Filesize
1.9MB

Download
memory/2752-22-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/2752-23-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download
memory/2888-16-0x00000000003E0000-0x00000000003EA000-memory.dmp

Filesize
40KB

Download
memory/2888-17-0x00000000003E0000-0x00000000003EA000-memory.dmp

Filesize
40KB

Download
memory/2888-14-0x00000000003F0000-0x0000000000582000-memory.dmp

Filesize
1.6MB

Download