xworm | 787e1242f848f583707880994edcaac36ba684a9202a42ad874a90e629119039

Analysis

max time kernel
439s
max time network
442s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
30-06-2024 06:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Packages.exe
Size

68KB
MD5

81b325d5cd48bfabdfc3f277362ff1a4
SHA1

557ac0ebcb4083398a09a9461c4872fc4995f954
SHA256

787e1242f848f583707880994edcaac36ba684a9202a42ad874a90e629119039
SHA512

1fb660131afe3fa5e6ad2fbce5d1e63bd960ce0bf51c86f1693d8fd2297b9a1586abd7a0ed196d0d749f4baca7c9ef843ee8287eeebc9aaf289dfcd34ec6af69
SSDEEP

1536:wLNUyuhSf1BkDEzxPzzb1Xp+w6SVY6arOnF/ff:wLNt9BL5zzb1Xp+w9V0rOnFnf

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Ironthing-22901.portmap.host:41205

field-clark.gl.at.ply.gg:41205

Attributes

Install_directory
%AppData%
install_file
Packages.exe

Signatures

Detect Xworm Payload 2 IoCs

Processes:

resource yara_rule

behavioral1/memory/1952-1-0x0000000000840000-0x0000000000858000-memory.dmp family_xworm
C:\Users\Admin\AppData\Roaming\Packages.exe family_xworm
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

3496 powershell.exe
4472 powershell.exe
4828 powershell.exe
248 powershell.exe

resource	yara_rule
behavioral1/memory/1952-1-0x0000000000840000-0x0000000000858000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Roaming\Packages.exe	family_xworm

pid	process
3496	powershell.exe
4472	powershell.exe
4828	powershell.exe
248	powershell.exe

Drops startup file 2 IoCs

Processes:

Packages.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Packages.lnk	Packages.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Packages.lnk	Packages.exe

Executes dropped EXE 7 IoCs

Processes:

Packages.exePackages.exePackages.exePackages.exePackages.exePackages.exePackages.exe

pid process

544 Packages.exe
780 Packages.exe
4124 Packages.exe
3724 Packages.exe
1420 Packages.exe
2816 Packages.exe
1032 Packages.exe

pid	process
544	Packages.exe
780	Packages.exe
4124	Packages.exe
3724	Packages.exe
1420	Packages.exe
2816	Packages.exe
1032	Packages.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Packages.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-423582142-4191893794-1888535462-1000\Software\Microsoft\Windows\CurrentVersion\Run\Packages = "C:\\Users\\Admin\\AppData\\Roaming\\Packages.exe"	Packages.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

1 ip-api.com

flow	ioc
1	ip-api.com

Drops file in Windows directory 4 IoCs

Processes:

UserOOBEBroker.exe

description	ioc	process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

MiniSearchHost.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-423582142-4191893794-1888535462-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

5056 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

248 powershell.exe
248 powershell.exe
3496 powershell.exe
3496 powershell.exe
4472 powershell.exe
4472 powershell.exe
4828 powershell.exe
4828 powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-423582142-4191893794-1888535462-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

pid	process
5056	schtasks.exe

pid	process
248	powershell.exe
248	powershell.exe
3496	powershell.exe
3496	powershell.exe
4472	powershell.exe
4472	powershell.exe
4828	powershell.exe
4828	powershell.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

Packages.exepowershell.exepowershell.exepowershell.exepowershell.exePackages.exePackages.exePackages.exePackages.exePackages.exePackages.exePackages.exe

description	pid	process
Token: SeDebugPrivilege	1952	Packages.exe
Token: SeDebugPrivilege	248	powershell.exe
Token: SeDebugPrivilege	3496	powershell.exe
Token: SeDebugPrivilege	4472	powershell.exe
Token: SeDebugPrivilege	4828	powershell.exe
Token: SeDebugPrivilege	1952	Packages.exe
Token: SeDebugPrivilege	544	Packages.exe
Token: SeDebugPrivilege	780	Packages.exe
Token: SeDebugPrivilege	4124	Packages.exe
Token: SeDebugPrivilege	3724	Packages.exe
Token: SeDebugPrivilege	1420	Packages.exe
Token: SeDebugPrivilege	2816	Packages.exe
Token: SeDebugPrivilege	1032	Packages.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

MiniSearchHost.exeOpenWith.exe

pid process

904 MiniSearchHost.exe
1660 OpenWith.exe

pid	process
904	MiniSearchHost.exe
1660	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

Packages.exe

description	pid	process	target process
PID 1952 wrote to memory of 248	1952	Packages.exe	powershell.exe
PID 1952 wrote to memory of 248	1952	Packages.exe	powershell.exe
PID 1952 wrote to memory of 3496	1952	Packages.exe	powershell.exe
PID 1952 wrote to memory of 3496	1952	Packages.exe	powershell.exe
PID 1952 wrote to memory of 4472	1952	Packages.exe	powershell.exe
PID 1952 wrote to memory of 4472	1952	Packages.exe	powershell.exe
PID 1952 wrote to memory of 4828	1952	Packages.exe	powershell.exe
PID 1952 wrote to memory of 4828	1952	Packages.exe	powershell.exe
PID 1952 wrote to memory of 5056	1952	Packages.exe	schtasks.exe
PID 1952 wrote to memory of 5056	1952	Packages.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Packages.exe
"C:\Users\Admin\AppData\Local\Temp\Packages.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1952

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Packages.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:248

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Packages.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3496

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Packages.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4472

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Packages.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4828

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Packages" /tr "C:\Users\Admin\AppData\Roaming\Packages.exe"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:5056

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4208

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:1264

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:4260

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1660

C:\Users\Admin\AppData\Roaming\Packages.exe
C:\Users\Admin\AppData\Roaming\Packages.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:544

C:\Users\Admin\AppData\Roaming\Packages.exe
C:\Users\Admin\AppData\Roaming\Packages.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:780

C:\Users\Admin\AppData\Roaming\Packages.exe
C:\Users\Admin\AppData\Roaming\Packages.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4124

C:\Users\Admin\AppData\Roaming\Packages.exe
C:\Users\Admin\AppData\Roaming\Packages.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3724

C:\Users\Admin\AppData\Roaming\Packages.exe
C:\Users\Admin\AppData\Roaming\Packages.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1420

C:\Users\Admin\AppData\Roaming\Packages.exe
C:\Users\Admin\AppData\Roaming\Packages.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2816

C:\Users\Admin\AppData\Roaming\Packages.exe
C:\Users\Admin\AppData\Roaming\Packages.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1032

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Packages.exe.log
Filesize
654B

MD5
2cbbb74b7da1f720b48ed31085cbd5b8

SHA1
79caa9a3ea8abe1b9c4326c3633da64a5f724964

SHA256
e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

SHA512
ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
2e8eb51096d6f6781456fef7df731d97

SHA1
ec2aaf851a618fb43c3d040a13a71997c25bda43

SHA256
96bfd9dd5883329927fe8c08b8956355a1a6ceb30ceeb5d4252b346df32bc864

SHA512
0a73dc9a49f92d9dd556c2ca2e36761890b3538f355ee1f013e7cf648d8c4d065f28046cd4a167db3dea304d1fbcbcea68d11ce6e12a3f20f8b6c018a60422d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
8cb7f4b4ab204cacd1af6b29c2a2042c

SHA1
244540c38e33eac05826d54282a0bfa60340d6a1

SHA256
4994013dabe4f131d401879278eee147add6349124ea6452358dca7e2344c7a6

SHA512
7651cb6863a425840db610253151e271d3e8da26a8c633ce484247266fa226792ecb84b9578df3ab17fef84a5dfcad417b63a7df59c9650a907e08d59b91dd6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
80707036df540b6657f9d443b449e3c3

SHA1
b3e7d5d97274942164bf93c8c4b8a9b68713f46f

SHA256
6651e5f976619cef991deef61776cf43d4c4b3d7c551dd2192b647df71586ab0

SHA512
65e41e9e730fed4f7a7d3f6f35875a16948b897f87c8c70b371fd0ac7f0951814f6a75e7698665194bbc65a3665a684e7be229e7e24193b50483ae7e55eebf4f

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize
10KB

MD5
76895a9958fcec9da538d1d9f09db9c2

SHA1
fd939724a66719fd6acfb55cd44ce901c9cb5fbd

SHA256
728c9cfd134307c0dbbefc344282c946b32f7f44d9c6b8af997636359b98257e

SHA512
f773262b808ec110def178dc79fb8da03bed38ed275fb6d002afe80a34f28f68f619163d589946eb3c8acadf436e72682a2a721fc3907718a903c84f02d93db6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0jxniwzw.zlk.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Packages.exe
Filesize
68KB

MD5
81b325d5cd48bfabdfc3f277362ff1a4

SHA1
557ac0ebcb4083398a09a9461c4872fc4995f954

SHA256
787e1242f848f583707880994edcaac36ba684a9202a42ad874a90e629119039

SHA512
1fb660131afe3fa5e6ad2fbce5d1e63bd960ce0bf51c86f1693d8fd2297b9a1586abd7a0ed196d0d749f4baca7c9ef843ee8287eeebc9aaf289dfcd34ec6af69

Download Submit
memory/248-14-0x00007FFBAF1F0000-0x00007FFBAFCB2000-memory.dmp

Filesize
10.8MB

Download
memory/248-15-0x00007FFBAF1F0000-0x00007FFBAFCB2000-memory.dmp

Filesize
10.8MB

Download
memory/248-16-0x00007FFBAF1F0000-0x00007FFBAFCB2000-memory.dmp

Filesize
10.8MB

Download
memory/248-19-0x00007FFBAF1F0000-0x00007FFBAFCB2000-memory.dmp

Filesize
10.8MB

Download
memory/248-13-0x00007FFBAF1F0000-0x00007FFBAFCB2000-memory.dmp

Filesize
10.8MB

Download
memory/248-12-0x00007FFBAF1F0000-0x00007FFBAFCB2000-memory.dmp

Filesize
10.8MB

Download
memory/248-8-0x0000028E5C6B0000-0x0000028E5C6D2000-memory.dmp

Filesize
136KB

Download
memory/1952-0-0x00007FFBAF1F3000-0x00007FFBAF1F5000-memory.dmp

Filesize
8KB

Download
memory/1952-2-0x00007FFBAF1F0000-0x00007FFBAFCB2000-memory.dmp

Filesize
10.8MB

Download
memory/1952-65-0x00007FFBAF1F0000-0x00007FFBAFCB2000-memory.dmp

Filesize
10.8MB

Download
memory/1952-1-0x0000000000840000-0x0000000000858000-memory.dmp

Filesize
96KB

Download