xworm | 6d5ff2230c713e9372d23989c3ea247d814ffc6f19380be86f7bccf3c0b6ff91

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 02:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WaveWindowsCracked.exe
Size

7.6MB
MD5

1aec1baab610e71d2dd83ddb08d9c49a
SHA1

47789c92be6ce830faa926acb1969086d410e4d4
SHA256

e2bfe1a9a590aab1f7572309b45c0cf88558f9c3463acb550d30e24f47132d1c
SHA512

2435a57bd91dae06c62ca1d209091f3ce4f3de9012eb80b901e89a62e60b28d45e5c94d018c5af5a831b3ff8d28e4bfc6e0c487125be14926a62b970e459690a
SSDEEP

196608:IUhZUvqevevx2QtiFX2PTiiXIeMeZ4SZCqL1:BhOvaZ+X2PG6Iep6SZCy

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

stewiegriffin-37537.portmap.host:37537

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Detect Xworm Payload 2 IoCs

Processes:

resource yara_rule

C:\Users\Admin\AppData\Roaming\DriverUpdt.exe family_xworm
behavioral1/memory/2808-14-0x0000000000D00000-0x0000000000D1C000-memory.dmp family_xworm
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

2820 powershell.exe
2884 powershell.exe
2536 powershell.exe
1200 powershell.exe

resource	yara_rule
C:\Users\Admin\AppData\Roaming\DriverUpdt.exe	family_xworm
behavioral1/memory/2808-14-0x0000000000D00000-0x0000000000D1C000-memory.dmp	family_xworm

pid	process
2820	powershell.exe
2884	powershell.exe
2536	powershell.exe
1200	powershell.exe

Drops startup file 2 IoCs

Processes:

DriverUpdt.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DriverUpdt.lnk	DriverUpdt.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DriverUpdt.lnk	DriverUpdt.exe

Executes dropped EXE 2 IoCs

Processes:

WaveWindows.exeDriverUpdt.exe

pid process

2448 WaveWindows.exe
2808 DriverUpdt.exe

pid	process
2448	WaveWindows.exe
2808	DriverUpdt.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

DriverUpdt.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\DriverUpdt = "C:\\Users\\Admin\\AppData\\Roaming\\DriverUpdt"	DriverUpdt.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2044 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

WaveWindows.exepowershell.exepowershell.exepowershell.exepowershell.exeDriverUpdt.exe

pid process

2448 WaveWindows.exe
2884 powershell.exe
2536 powershell.exe
1200 powershell.exe
2820 powershell.exe
2808 DriverUpdt.exe

flow	ioc
2	ip-api.com

pid	process
2044	schtasks.exe

pid	process
2448	WaveWindows.exe
2884	powershell.exe
2536	powershell.exe
1200	powershell.exe
2820	powershell.exe
2808	DriverUpdt.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

DriverUpdt.exeWaveWindows.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2808	DriverUpdt.exe
Token: SeDebugPrivilege	2448	WaveWindows.exe
Token: SeDebugPrivilege	2884	powershell.exe
Token: SeDebugPrivilege	2536	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeDebugPrivilege	2808	DriverUpdt.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

DriverUpdt.exe

pid process

2808 DriverUpdt.exe

pid	process
2808	DriverUpdt.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

WaveWindowsCracked.exeDriverUpdt.exe

description	pid	process	target process
PID 2020 wrote to memory of 2448	2020	WaveWindowsCracked.exe	WaveWindows.exe
PID 2020 wrote to memory of 2448	2020	WaveWindowsCracked.exe	WaveWindows.exe
PID 2020 wrote to memory of 2448	2020	WaveWindowsCracked.exe	WaveWindows.exe
PID 2020 wrote to memory of 2448	2020	WaveWindowsCracked.exe	WaveWindows.exe
PID 2020 wrote to memory of 2808	2020	WaveWindowsCracked.exe	DriverUpdt.exe
PID 2020 wrote to memory of 2808	2020	WaveWindowsCracked.exe	DriverUpdt.exe
PID 2020 wrote to memory of 2808	2020	WaveWindowsCracked.exe	DriverUpdt.exe
PID 2808 wrote to memory of 2884	2808	DriverUpdt.exe	powershell.exe
PID 2808 wrote to memory of 2884	2808	DriverUpdt.exe	powershell.exe
PID 2808 wrote to memory of 2884	2808	DriverUpdt.exe	powershell.exe
PID 2808 wrote to memory of 2536	2808	DriverUpdt.exe	powershell.exe
PID 2808 wrote to memory of 2536	2808	DriverUpdt.exe	powershell.exe
PID 2808 wrote to memory of 2536	2808	DriverUpdt.exe	powershell.exe
PID 2808 wrote to memory of 1200	2808	DriverUpdt.exe	powershell.exe
PID 2808 wrote to memory of 1200	2808	DriverUpdt.exe	powershell.exe
PID 2808 wrote to memory of 1200	2808	DriverUpdt.exe	powershell.exe
PID 2808 wrote to memory of 2820	2808	DriverUpdt.exe	powershell.exe
PID 2808 wrote to memory of 2820	2808	DriverUpdt.exe	powershell.exe
PID 2808 wrote to memory of 2820	2808	DriverUpdt.exe	powershell.exe
PID 2808 wrote to memory of 2044	2808	DriverUpdt.exe	schtasks.exe
PID 2808 wrote to memory of 2044	2808	DriverUpdt.exe	schtasks.exe
PID 2808 wrote to memory of 2044	2808	DriverUpdt.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\WaveWindowsCracked.exe
"C:\Users\Admin\AppData\Local\Temp\WaveWindowsCracked.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2020

C:\Users\Admin\AppData\Roaming\WaveWindows.exe
"C:\Users\Admin\AppData\Roaming\WaveWindows.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2448

C:\Users\Admin\AppData\Roaming\DriverUpdt.exe
"C:\Users\Admin\AppData\Roaming\DriverUpdt.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\DriverUpdt.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2884

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'DriverUpdt.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2536

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\DriverUpdt'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'DriverUpdt'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2820

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "DriverUpdt" /tr "C:\Users\Admin\AppData\Roaming\DriverUpdt"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2044

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\DriverUpdt.exe
Filesize
84KB

MD5
65485b0475b6c8a3b4f35bba541938a6

SHA1
28e6e6cd2ebf8a9fdffeb4aeba13b70ea7ea03a3

SHA256
c6740ee5c8afdc2c7be42fb03ab5a346925efc6ac785fe7d68dec2d5f05d276b

SHA512
034303ee48132b80da79e54a6077676cfd436ef869493a11a27c29dc7cb730fd2ce902320d554a0cde81fc0a06f6c56efa5c170a1360906ec9fa7fd101c3706d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
cf2d861527b0364c973a1a79a76ddea0

SHA1
057a2894799984d7f44294cffff10cbc790b538a

SHA256
95da065fe2322c3bdfa6981285015b4dd0f099174699310e521e92ad46d671bd

SHA512
7908a924ade3b41288d4536541dd490da26c3196ecc4bd4919886d0f103290b9b08a99f714435ff19113bd844c02d767a233698d900c291d2ecec3773593dc44

Download Submit
C:\Users\Admin\AppData\Roaming\WaveWindows.exe
Filesize
7.5MB

MD5
cd34bf9c69f229818a4c9301e51435eb

SHA1
bfb95a5dc5d777e2b5940f354da271fed397adb2

SHA256
3b217daf815ced5cf1087d1f408fc3833c9d80a1e3e25b3f9041698b9e34216f

SHA512
2c68b211a4c8c144713cbe99214e8dc33d3ef6c1f244af4a313ff5ab93d946a4281d404b02c5f66ef5652071279649082877eaa728912a0e769c2c848e0a8e6b

Download Submit
memory/2020-0-0x000007FEF53E3000-0x000007FEF53E4000-memory.dmp

Filesize
4KB

Download
memory/2020-1-0x0000000001210000-0x00000000019B6000-memory.dmp

Filesize
7.6MB

Download
memory/2448-15-0x0000000000220000-0x00000000009AC000-memory.dmp

Filesize
7.5MB

Download
memory/2448-16-0x0000000001130000-0x000000000117A000-memory.dmp

Filesize
296KB

Download
memory/2448-17-0x0000000000CD0000-0x0000000000CF4000-memory.dmp

Filesize
144KB

Download
memory/2448-18-0x0000000005970000-0x0000000005A56000-memory.dmp

Filesize
920KB

Download
memory/2448-10-0x00000000742BE000-0x00000000742BF000-memory.dmp

Filesize
4KB

Download
memory/2536-30-0x000000001B660000-0x000000001B942000-memory.dmp

Filesize
2.9MB

Download
memory/2536-31-0x0000000001EC0000-0x0000000001EC8000-memory.dmp

Filesize
32KB

Download
memory/2808-14-0x0000000000D00000-0x0000000000D1C000-memory.dmp

Filesize
112KB

Download
memory/2884-23-0x000000001B740000-0x000000001BA22000-memory.dmp

Filesize
2.9MB

Download
memory/2884-24-0x0000000001E10000-0x0000000001E18000-memory.dmp

Filesize
32KB

Download