xworm

General

Target

Runtime Broker.exe
Size

72KB
Sample

240630-v7l1kavdjm
MD5

89af2aaffc3ddda07a0fc977c8bb2236
SHA1

412bd5812599d5729a51d0350df48030b0d04e1a
SHA256

637aff987be6ea158b7182de9de5de0054407077511019516270d82a6f2e9b69
SHA512

8c2b26d0f1b0ae80149a2aaadef329ab7fb3495bdfbccb7f8ff60368094cd955829b2cb1217b16808ac41a223661d48c2dcf88d3daeddc6b699aa88272be75ae
SSDEEP

1536:b0nLpERHZ5P56srqpbTXw3cYUo6IfI4WOyL6KqGi:bcY7P56tbTXb6IvOyyGi

Score

10^/10

Malware Config

Extracted

Family

xworm

C2

medical-m.gl.at.ply.gg:28857

Attributes

Install_directory
%ProgramData%
install_file
Runtime Broker.exe

Targets

- Target
  
  Runtime Broker.exe
- Size
  
  72KB
- MD5
  
  89af2aaffc3ddda07a0fc977c8bb2236
- SHA1
  
  412bd5812599d5729a51d0350df48030b0d04e1a
- SHA256
  
  637aff987be6ea158b7182de9de5de0054407077511019516270d82a6f2e9b69
- SHA512
  
  8c2b26d0f1b0ae80149a2aaadef329ab7fb3495bdfbccb7f8ff60368094cd955829b2cb1217b16808ac41a223661d48c2dcf88d3daeddc6b699aa88272be75ae
- SSDEEP
  
  1536:b0nLpERHZ5P56srqpbTXw3cYUo6IfI4WOyL6KqGi:bcY7P56tbTXb6IvOyyGi
Score

10^/10

xworm rat trojan execution persistence ransomware
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Extracted

Targets

Contains code to disable Windows Defender

Detect Xworm Payload

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Drops startup file

Executes dropped EXE

Uses the VBS compiler for execution

Adds Run key to start application

Enumerates connected drives

Looks up external IP address via web service

Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2