xworm | ac457a57600ba7fd011d94e6574b935a9589dd60b63d6ee6b5db67342ce5710e

Analysis

max time kernel
5s
max time network
55s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
30-06-2024 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XClient.exe
Size

40KB
MD5

a2abffd7525046355e99e8673c3701fe
SHA1

6e1aaff66b5aac7a1c3df969b36da6141a95a4f9
SHA256

ac457a57600ba7fd011d94e6574b935a9589dd60b63d6ee6b5db67342ce5710e
SHA512

96b3b3750d9abaa627780eccb74dd870bb84ad1fb928233844054b2d24306f6f937f0762619d0b0209a8744aabbe278c773539fb8791987606427d8bfa767d22
SSDEEP

768:olc+DXf6pUAbfsW09Uf929NiTnFPw9in6rOphHuUF8M:oW+upUADfnuNYFY9in6rOpxf8M

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

amount-acceptance.gl.at.ply.gg:7420

Mutex

k2N8rf6LqCqdtF6c

Attributes

Install_directory
%ProgramData%
install_file
svhost.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

Processes:

resource yara_rule

behavioral1/memory/1548-1-0x0000000000E30000-0x0000000000E40000-memory.dmp family_xworm
C:\ProgramData\svhost.exe family_xworm
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

3024 powershell.exe
1644 powershell.exe
4448 powershell.exe
4912 powershell.exe
Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Processes:

XClient.exe

description ioc process

Set value (str) \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\ProgramData\\svhost.exe" XClient.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

1908 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

3024 powershell.exe
3024 powershell.exe
1644 powershell.exe
1644 powershell.exe
4448 powershell.exe
4448 powershell.exe
4912 powershell.exe
4912 powershell.exe

resource	yara_rule
behavioral1/memory/1548-1-0x0000000000E30000-0x0000000000E40000-memory.dmp	family_xworm
C:\ProgramData\svhost.exe	family_xworm

pid	process
3024	powershell.exe
1644	powershell.exe
4448	powershell.exe
4912	powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\ProgramData\\svhost.exe"	XClient.exe

pid	process
1908	schtasks.exe

pid	process
3024	powershell.exe
3024	powershell.exe
1644	powershell.exe
1644	powershell.exe
4448	powershell.exe
4448	powershell.exe
4912	powershell.exe
4912	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

XClient.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1548	XClient.exe
Token: SeDebugPrivilege	3024	powershell.exe
Token: SeDebugPrivilege	1644	powershell.exe
Token: SeDebugPrivilege	4448	powershell.exe
Token: SeDebugPrivilege	4912	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

XClient.exe

description	pid	process	target process
PID 1548 wrote to memory of 3024	1548	XClient.exe	powershell.exe
PID 1548 wrote to memory of 3024	1548	XClient.exe	powershell.exe
PID 1548 wrote to memory of 1644	1548	XClient.exe	powershell.exe
PID 1548 wrote to memory of 1644	1548	XClient.exe	powershell.exe
PID 1548 wrote to memory of 4448	1548	XClient.exe	powershell.exe
PID 1548 wrote to memory of 4448	1548	XClient.exe	powershell.exe
PID 1548 wrote to memory of 4912	1548	XClient.exe	powershell.exe
PID 1548 wrote to memory of 4912	1548	XClient.exe	powershell.exe
PID 1548 wrote to memory of 1908	1548	XClient.exe	schtasks.exe
PID 1548 wrote to memory of 1908	1548	XClient.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1548

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3024

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1644

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svhost.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4448

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4912

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svhost" /tr "C:\ProgramData\svhost.exe"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:1908

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
PID:4184

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
PID:1056

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\svhost.exe
Filesize
40KB

MD5
a2abffd7525046355e99e8673c3701fe

SHA1
6e1aaff66b5aac7a1c3df969b36da6141a95a4f9

SHA256
ac457a57600ba7fd011d94e6574b935a9589dd60b63d6ee6b5db67342ce5710e

SHA512
96b3b3750d9abaa627780eccb74dd870bb84ad1fb928233844054b2d24306f6f937f0762619d0b0209a8744aabbe278c773539fb8791987606427d8bfa767d22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
d0a4a3b9a52b8fe3b019f6cd0ef3dad6

SHA1
fed70ce7834c3b97edbd078eccda1e5effa527cd

SHA256
21942e513f223fdad778348fbb20617dd29f986bccd87824c0ae7f15649f3f31

SHA512
1a66f837b4e7fb6346d0500aeacb44902fb8a239bce23416271263eba46fddae58a17075e188ae43eb516c841e02c87e32ebd73256c7cc2c0713d00c35f1761b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
e07eea85a8893f23fb814cf4b3ed974c

SHA1
8a8125b2890bbddbfc3531d0ee4393dbbf5936fe

SHA256
83387ce468d717a7b4ba238af2273da873b731a13cc35604f775a31fa0ac70ea

SHA512
9d4808d8a261005391388b85da79e4c5396bdded6e7e5ce3a3a23e7359d1aa1fb983b4324f97e0afec6e8ed9d898322ca258dd7cda654456dd7e84c9cbd509df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
80b42fe4c6cf64624e6c31e5d7f2d3b3

SHA1
1f93e7dd83b86cb900810b7e3e43797868bf7d93

SHA256
ee20a5b38a6674366efda276dbbf0b43eb54efd282acfc1033042f6b53a80d4d

SHA512
83c1c744c15a8b427a1d3af677ec3bfd0353875a60fe886c41570981e17467ebbb59619b960ca8c5c3ab1430946b0633ea200b7e7d84ab6dca88b60c50055573

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize
10KB

MD5
e9aa12ff0be6d995ed86f8cf88678158

SHA1
e5ee38fc2ebef0fcbc3059dee29b39f7daf21931

SHA256
f35cd8ef03ac924a59943c5dfffc31ab67a8b5aff272e9f47ff776aabc7ee561

SHA512
95a67acd2a4784b87d73910c1f1f590937c9d9b901e98448556a37eb8137ae5f458f1c673d65a46cf7d6b90bee5fe6b102ce3eeac9e819062cd9c5c2418bcbfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gnoajdb2.1u3.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1548-52-0x00007FFF21030000-0x00007FFF21AF2000-memory.dmp

Filesize
10.8MB

Download
memory/1548-0-0x00007FFF21033000-0x00007FFF21035000-memory.dmp

Filesize
8KB

Download
memory/1548-56-0x00007FFF21030000-0x00007FFF21AF2000-memory.dmp

Filesize
10.8MB

Download
memory/1548-1-0x0000000000E30000-0x0000000000E40000-memory.dmp

Filesize
64KB

Download
memory/3024-16-0x00007FFF21030000-0x00007FFF21AF2000-memory.dmp

Filesize
10.8MB

Download
memory/3024-15-0x00007FFF21030000-0x00007FFF21AF2000-memory.dmp

Filesize
10.8MB

Download
memory/3024-12-0x00007FFF21030000-0x00007FFF21AF2000-memory.dmp

Filesize
10.8MB

Download
memory/3024-11-0x00007FFF21030000-0x00007FFF21AF2000-memory.dmp

Filesize
10.8MB

Download
memory/3024-7-0x0000016AF71D0000-0x0000016AF71F2000-memory.dmp

Filesize
136KB

Download