xworm | 8f619c4d07c848855b27863e887f95f7307ae2d46f64c661ca17a2d96798a2af

Analysis

max time kernel
30s
max time network
33s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 01:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dll (1).exe
Size

1.8MB
MD5

2d8725f268c90475c94941e550019cf9
SHA1

c51ed1a97e71cbdfb7712f7fbe2251553f1054b7
SHA256

8f619c4d07c848855b27863e887f95f7307ae2d46f64c661ca17a2d96798a2af
SHA512

4998e8bf9e33f31e895783e31185fd678c368e3eb3b524b65ff1d988f0395cdd8d7a1aa6776d89b1f284656f2e6c97b848d8e909c167b52932a1d83382e57bb1
SSDEEP

49152:d78cpUcrJCoHjuFnBPn20DRt8HcWynnBvIyn+inbT:d78cpUcrJC2q9BPjo8WyBv1n+in

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

127.0.0.1:35472

haxxy999-35472.portmap.host:35472

Attributes

Install_directory
%Temp%
install_file
svchost.exe

Signatures

Detect Xworm Payload 2 IoCs

Processes:

resource yara_rule

C:\Users\Admin\Feather new.exe family_xworm
behavioral2/memory/3088-61-0x00000000009F0000-0x0000000000A0C000-memory.dmp family_xworm
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

2580 powershell.exe
1352 powershell.exe
2324 powershell.exe
3600 powershell.exe

resource	yara_rule
C:\Users\Admin\Feather new.exe	family_xworm
behavioral2/memory/3088-61-0x00000000009F0000-0x0000000000A0C000-memory.dmp	family_xworm

pid	process
2580	powershell.exe
1352	powershell.exe
2324	powershell.exe
3600	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Feather new.exedll (1).exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	Feather new.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	dll (1).exe

Drops startup file 2 IoCs

Processes:

Feather new.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	Feather new.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	Feather new.exe

Executes dropped EXE 2 IoCs

Processes:

WaveInstaller.exeFeather new.exe

pid process

924 WaveInstaller.exe
3088 Feather new.exe

pid	process
924	WaveInstaller.exe
3088	Feather new.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Feather new.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe"	Feather new.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

13 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

1356 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeFeather new.exe

pid process

3600 powershell.exe
3600 powershell.exe
2580 powershell.exe
2580 powershell.exe
1352 powershell.exe
1352 powershell.exe
2324 powershell.exe
2324 powershell.exe
3088 Feather new.exe

flow	ioc
13	ip-api.com

pid	process
1356	schtasks.exe

pid	process
3600	powershell.exe
3600	powershell.exe
2580	powershell.exe
2580	powershell.exe
1352	powershell.exe
1352	powershell.exe
2324	powershell.exe
2324	powershell.exe
3088	Feather new.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

Feather new.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	3088	Feather new.exe
Token: SeDebugPrivilege	3600	powershell.exe
Token: SeDebugPrivilege	2580	powershell.exe
Token: SeDebugPrivilege	1352	powershell.exe
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeDebugPrivilege	3088	Feather new.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Feather new.exe

pid process

3088 Feather new.exe

pid	process
3088	Feather new.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

dll (1).exeFeather new.exe

description	pid	process	target process
PID 732 wrote to memory of 924	732	dll (1).exe	WaveInstaller.exe
PID 732 wrote to memory of 924	732	dll (1).exe	WaveInstaller.exe
PID 732 wrote to memory of 924	732	dll (1).exe	WaveInstaller.exe
PID 732 wrote to memory of 3088	732	dll (1).exe	Feather new.exe
PID 732 wrote to memory of 3088	732	dll (1).exe	Feather new.exe
PID 3088 wrote to memory of 3600	3088	Feather new.exe	powershell.exe
PID 3088 wrote to memory of 3600	3088	Feather new.exe	powershell.exe
PID 3088 wrote to memory of 2580	3088	Feather new.exe	powershell.exe
PID 3088 wrote to memory of 2580	3088	Feather new.exe	powershell.exe
PID 3088 wrote to memory of 1352	3088	Feather new.exe	powershell.exe
PID 3088 wrote to memory of 1352	3088	Feather new.exe	powershell.exe
PID 3088 wrote to memory of 2324	3088	Feather new.exe	powershell.exe
PID 3088 wrote to memory of 2324	3088	Feather new.exe	powershell.exe
PID 3088 wrote to memory of 1356	3088	Feather new.exe	schtasks.exe
PID 3088 wrote to memory of 1356	3088	Feather new.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\dll (1).exe
"C:\Users\Admin\AppData\Local\Temp\dll (1).exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:732

C:\Users\Admin\WaveInstaller.exe
"C:\Users\Admin\WaveInstaller.exe"
2⤵
- Executes dropped EXE
PID:924

C:\Users\Admin\Feather new.exe
"C:\Users\Admin\Feather new.exe"
2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3088

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Feather new.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3600

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Feather new.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2580

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1352

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2324

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:1356

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
34f595487e6bfd1d11c7de88ee50356a

SHA1
4caad088c15766cc0fa1f42009260e9a02f953bb

SHA256
0f9a4b52e01cb051052228a55d0515911b7ef5a8db3cf925528c746df511424d

SHA512
10976c5deaf9fac449e703e852c3b08d099f430de2d7c7b8e2525c35d63e28b890e5aab63feff9b20bca0aaf9f35a3ba411aee3fbeee9ea59f90ed25bd617a0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
75d224e238a397659d8e5cf458a41143

SHA1
d182d16283d3d864a2e328b677551428c29ad6df

SHA256
6a98fa5e6c5b77722f2bd8c855fd14d6bf545fc35b292252d1dc136b89ed2fee

SHA512
3477f3b4182ffdccc817de4242c8fcba706c193a0de5170cd023f8df3d330487d7e372556524b5a0fe1df56de40923700f3f8368eadf6601970e347cbcf078cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qowonriw.wke.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Feather new.exe
Filesize
87KB

MD5
d937a01ea0bd6d64bf218bf9f052601d

SHA1
e47417cb8773b13c66717cc3137bda4f919578b2

SHA256
8d2252827e127ba22c6645d57981a0556149255ec6b430582c02d9e6b8cb2adb

SHA512
b1d73cf9377f1dcb774bce9840fafe950e44ab3d39763c2a12c918fb8a0a8de463a24b127388b59dae5fedd1147387ee9b1d0d1fcc0451d16094495f8703c0cd

Download Submit
C:\Users\Admin\WaveInstaller.exe
Filesize
1.5MB

MD5
b075f4320e46d0d5e78a649e8ee011cc

SHA1
b0dd50171323f0f83dbea0340e9ed8cf44bea38e

SHA256
8581823244a50bbed9709d09f3eba29dd9989681d96bff2b6c19245053069feb

SHA512
e08024b5fa50dc344ca18413a6c21e0f20490c22c90c565d6f663014f1673643da1d5d748e0cefca8a7cbae91a62470289803ad588d3aa5cf3dc6292d7393d47

Download Submit
memory/732-1-0x0000000000C20000-0x0000000000DFE000-memory.dmp

Filesize
1.9MB

Download
memory/732-0-0x00007FFF39173000-0x00007FFF39175000-memory.dmp

Filesize
8KB

Download
memory/924-62-0x00000000000E0000-0x0000000000272000-memory.dmp

Filesize
1.6MB

Download
memory/924-67-0x00000000093C0000-0x00000000093CE000-memory.dmp

Filesize
56KB

Download
memory/924-66-0x000000000A310000-0x000000000A348000-memory.dmp

Filesize
224KB

Download
memory/924-65-0x00000000752D0000-0x0000000075A80000-memory.dmp

Filesize
7.7MB

Download
memory/924-64-0x00000000752DE000-0x00000000752DF000-memory.dmp

Filesize
4KB

Download
memory/924-121-0x00000000752D0000-0x0000000075A80000-memory.dmp

Filesize
7.7MB

Download
memory/3088-68-0x0000000001370000-0x0000000001380000-memory.dmp

Filesize
64KB

Download
memory/3088-63-0x00007FFF39170000-0x00007FFF39C31000-memory.dmp

Filesize
10.8MB

Download
memory/3088-61-0x00000000009F0000-0x0000000000A0C000-memory.dmp

Filesize
112KB

Download
memory/3088-119-0x00007FFF39170000-0x00007FFF39C31000-memory.dmp

Filesize
10.8MB

Download
memory/3088-120-0x000000001C6C0000-0x000000001C6CC000-memory.dmp

Filesize
48KB

Download
memory/3088-122-0x0000000001370000-0x0000000001380000-memory.dmp

Filesize
64KB

Download
memory/3600-74-0x0000019972D20000-0x0000019972D42000-memory.dmp

Filesize
136KB

Download