xworm | 455c691649fb976fe7c7c1c816b97972c1826e3f053e483cdeaea9a839b05944

Analysis

max time kernel
122s
max time network
141s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 01:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe
Size

230KB
MD5

3db7f780cfc50d086820b95947a61e59
SHA1

d0d31e30bf5f0b39229fb6db2bd73a42ab61eb9d
SHA256

e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f
SHA512

36f184e595612b65563e8b578b3b319716e516d140aef7aa6afae786b036c77b0cc99a2a2cd94cbd548dcfcf82554a891eec0d0d7973a59be5e85606f172dfd8
SSDEEP

6144:y2lnab4waqIUhcX7elbKTua9bfF/H9d9n:blHqI3X3u+

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

154.197.69.131:7005

Attributes

Install_directory
%AppData%
install_file
crss.exe

Signatures

Detect Xworm Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2088-1-0x0000000000EB0000-0x0000000000EEE000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Roaming\crss.exe	family_xworm
behavioral1/memory/1192-36-0x0000000000360000-0x000000000039E000-memory.dmp	family_xworm
behavioral1/memory/1752-39-0x0000000000070000-0x00000000000AE000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

1268 powershell.exe
2164 powershell.exe
2792 powershell.exe
2332 powershell.exe

pid	process
1268	powershell.exe
2164	powershell.exe
2792	powershell.exe
2332	powershell.exe

Drops startup file 2 IoCs

Processes:

e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crss.lnk	e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crss.lnk	e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe

Executes dropped EXE 2 IoCs

Processes:

crss.execrss.exe

pid process

1192 crss.exe
1752 crss.exe

pid	process
1192	crss.exe
1752	crss.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\crss = "C:\\Users\\Admin\\AppData\\Roaming\\crss.exe"	e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

908 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exee2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe

pid process

1268 powershell.exe
2164 powershell.exe
2792 powershell.exe
2332 powershell.exe
2088 e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe

flow	ioc
4	ip-api.com

pid	process
908	schtasks.exe

pid	process
1268	powershell.exe
2164	powershell.exe
2792	powershell.exe
2332	powershell.exe
2088	e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exepowershell.exepowershell.exepowershell.exepowershell.execrss.execrss.exe

description	pid	process
Token: SeDebugPrivilege	2088	e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe
Token: SeDebugPrivilege	1268	powershell.exe
Token: SeDebugPrivilege	2164	powershell.exe
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeDebugPrivilege	2332	powershell.exe
Token: SeDebugPrivilege	2088	e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe
Token: SeDebugPrivilege	1192	crss.exe
Token: SeDebugPrivilege	1752	crss.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe

pid process

2088 e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe

pid	process
2088	e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exetaskeng.exe

description	pid	process	target process
PID 2088 wrote to memory of 1268	2088	e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe	powershell.exe
PID 2088 wrote to memory of 1268	2088	e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe	powershell.exe
PID 2088 wrote to memory of 1268	2088	e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe	powershell.exe
PID 2088 wrote to memory of 2164	2088	e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe	powershell.exe
PID 2088 wrote to memory of 2164	2088	e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe	powershell.exe
PID 2088 wrote to memory of 2164	2088	e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe	powershell.exe
PID 2088 wrote to memory of 2792	2088	e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe	powershell.exe
PID 2088 wrote to memory of 2792	2088	e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe	powershell.exe
PID 2088 wrote to memory of 2792	2088	e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe	powershell.exe
PID 2088 wrote to memory of 2332	2088	e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe	powershell.exe
PID 2088 wrote to memory of 2332	2088	e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe	powershell.exe
PID 2088 wrote to memory of 2332	2088	e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe	powershell.exe
PID 2088 wrote to memory of 908	2088	e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe	schtasks.exe
PID 2088 wrote to memory of 908	2088	e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe	schtasks.exe
PID 2088 wrote to memory of 908	2088	e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe	schtasks.exe
PID 2560 wrote to memory of 1192	2560	taskeng.exe	crss.exe
PID 2560 wrote to memory of 1192	2560	taskeng.exe	crss.exe
PID 2560 wrote to memory of 1192	2560	taskeng.exe	crss.exe
PID 2560 wrote to memory of 1752	2560	taskeng.exe	crss.exe
PID 2560 wrote to memory of 1752	2560	taskeng.exe	crss.exe
PID 2560 wrote to memory of 1752	2560	taskeng.exe	crss.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe
"C:\Users\Admin\AppData\Local\Temp\e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1268

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2164

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\crss.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2792

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'crss.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2332

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "crss" /tr "C:\Users\Admin\AppData\Roaming\crss.exe"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:908

C:\Windows\system32\taskeng.exe
taskeng.exe {1B41CCB9-7478-4F0C-AFB5-4F13210C0253} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2560

C:\Users\Admin\AppData\Roaming\crss.exe
C:\Users\Admin\AppData\Roaming\crss.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1192

C:\Users\Admin\AppData\Roaming\crss.exe
C:\Users\Admin\AppData\Roaming\crss.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1752

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
a8b1b5ca5c107f9d028ca1298e83324a

SHA1
1448b5eb2fed3acbb2e5d05aecfb1717182a7320

SHA256
84d430461dfc5e08fda005e67b6b33871854dc0ef9cb4045fd0fa5e3d9049bd9

SHA512
43b91819f779013b168db55fd5deeba5be3d0115fe9edf593ce7747be77d2684086f6e96ac2bcdf869e466124d23e6cbce1d7e3785ce9a230cc0ad5bf8ae57cc

Download Submit
C:\Users\Admin\AppData\Roaming\crss.exe
Filesize
230KB

MD5
3db7f780cfc50d086820b95947a61e59

SHA1
d0d31e30bf5f0b39229fb6db2bd73a42ab61eb9d

SHA256
e2a569f0f5168d11500b6e5f5c0ad0c900c45be7cbab68f0c354318123bf942f

SHA512
36f184e595612b65563e8b578b3b319716e516d140aef7aa6afae786b036c77b0cc99a2a2cd94cbd548dcfcf82554a891eec0d0d7973a59be5e85606f172dfd8

Download Submit
memory/1192-36-0x0000000000360000-0x000000000039E000-memory.dmp

Filesize
248KB

Download
memory/1268-7-0x0000000002840000-0x00000000028C0000-memory.dmp

Filesize
512KB

Download
memory/1268-8-0x000000001B6B0000-0x000000001B992000-memory.dmp

Filesize
2.9MB

Download
memory/1268-9-0x0000000001E70000-0x0000000001E78000-memory.dmp

Filesize
32KB

Download
memory/1752-39-0x0000000000070000-0x00000000000AE000-memory.dmp

Filesize
248KB

Download
memory/2088-0-0x000007FEF5BB3000-0x000007FEF5BB4000-memory.dmp

Filesize
4KB

Download
memory/2088-31-0x000007FEF5BB3000-0x000007FEF5BB4000-memory.dmp

Filesize
4KB

Download
memory/2088-32-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp

Filesize
9.9MB

Download
memory/2088-2-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp

Filesize
9.9MB

Download
memory/2088-1-0x0000000000EB0000-0x0000000000EEE000-memory.dmp

Filesize
248KB

Download
memory/2164-15-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Filesize
2.9MB

Download
memory/2164-16-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download