xworm | 804a92bb8ebfbe27bc482e76e2d8675f33f4257d3497a92105dc8bfa09011153

Analysis

max time kernel
143s
max time network
146s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe
Size

39KB
MD5

7574843f91261ab512b368ce7942d6ae
SHA1

901ad41ebcf742e242f0628f8aa5570edc0999b5
SHA256

c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b
SHA512

0ae4db524ea03ef2f3b74c60dbe772d69d733392ae78705d13d27a9ebe5cd8b6ee9d9ba51bc0d59980a0922730f8930ffbf246e735e53abb52a2910f52d838cb
SSDEEP

768:IfP7EV11K5acblLJKuuwhS5vypufFWPa9bt6POwhoaibE:SDEV10wuVJKuuwhSIEFv9bt6POwyjQ

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

64.23.249.117:6098

Mutex

qBm7HSWbfhJrOf6O

Attributes

Install_directory
%AppData%
install_file
XClient.exe

aes.plain

Signatures

Detect Xworm Payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2240-1-0x0000000000BD0000-0x0000000000BE0000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Roaming\XClient.exe	family_xworm
behavioral1/memory/2268-36-0x00000000011F0000-0x0000000001200000-memory.dmp	family_xworm
behavioral1/memory/2720-40-0x0000000000140000-0x0000000000150000-memory.dmp	family_xworm
behavioral1/memory/3036-42-0x00000000001F0000-0x0000000000200000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

2884 powershell.exe
2800 powershell.exe
2408 powershell.exe
2376 powershell.exe

pid	process
2884	powershell.exe
2800	powershell.exe
2408	powershell.exe
2376	powershell.exe

Drops startup file 2 IoCs

Processes:

c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe

Executes dropped EXE 3 IoCs

Processes:

XClient.exeXClient.exeXClient.exe

pid process

2268 XClient.exe
2720 XClient.exe
3036 XClient.exe

pid	process
2268	XClient.exe
2720	XClient.exe
3036	XClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2888 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exec826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe

pid process

2884 powershell.exe
2800 powershell.exe
2408 powershell.exe
2376 powershell.exe
2240 c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe

pid	process
2888	schtasks.exe

pid	process
2884	powershell.exe
2800	powershell.exe
2408	powershell.exe
2376	powershell.exe
2240	c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exepowershell.exepowershell.exepowershell.exepowershell.exeXClient.exeXClient.exeXClient.exe

description	pid	process
Token: SeDebugPrivilege	2240	c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe
Token: SeDebugPrivilege	2884	powershell.exe
Token: SeDebugPrivilege	2800	powershell.exe
Token: SeDebugPrivilege	2408	powershell.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeDebugPrivilege	2240	c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe
Token: SeDebugPrivilege	2268	XClient.exe
Token: SeDebugPrivilege	2720	XClient.exe
Token: SeDebugPrivilege	3036	XClient.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe

pid process

2240 c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe

pid	process
2240	c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exetaskeng.exe

description	pid	process	target process
PID 2240 wrote to memory of 2884	2240	c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe	powershell.exe
PID 2240 wrote to memory of 2884	2240	c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe	powershell.exe
PID 2240 wrote to memory of 2884	2240	c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe	powershell.exe
PID 2240 wrote to memory of 2800	2240	c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe	powershell.exe
PID 2240 wrote to memory of 2800	2240	c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe	powershell.exe
PID 2240 wrote to memory of 2800	2240	c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe	powershell.exe
PID 2240 wrote to memory of 2408	2240	c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe	powershell.exe
PID 2240 wrote to memory of 2408	2240	c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe	powershell.exe
PID 2240 wrote to memory of 2408	2240	c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe	powershell.exe
PID 2240 wrote to memory of 2376	2240	c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe	powershell.exe
PID 2240 wrote to memory of 2376	2240	c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe	powershell.exe
PID 2240 wrote to memory of 2376	2240	c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe	powershell.exe
PID 2240 wrote to memory of 2888	2240	c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe	schtasks.exe
PID 2240 wrote to memory of 2888	2240	c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe	schtasks.exe
PID 2240 wrote to memory of 2888	2240	c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe	schtasks.exe
PID 1676 wrote to memory of 2268	1676	taskeng.exe	XClient.exe
PID 1676 wrote to memory of 2268	1676	taskeng.exe	XClient.exe
PID 1676 wrote to memory of 2268	1676	taskeng.exe	XClient.exe
PID 1676 wrote to memory of 2720	1676	taskeng.exe	XClient.exe
PID 1676 wrote to memory of 2720	1676	taskeng.exe	XClient.exe
PID 1676 wrote to memory of 2720	1676	taskeng.exe	XClient.exe
PID 1676 wrote to memory of 3036	1676	taskeng.exe	XClient.exe
PID 1676 wrote to memory of 3036	1676	taskeng.exe	XClient.exe
PID 1676 wrote to memory of 3036	1676	taskeng.exe	XClient.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe
"C:\Users\Admin\AppData\Local\Temp\c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2884

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2800

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2408

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2376

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\taskeng.exe
taskeng.exe {6CD41408-6CB2-41BD-B24A-03EB24F46AC6} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1676

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2268

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2720

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3036

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
327b0202ac19445140c799f546c112f7

SHA1
f9fef3ce164529bca0c073ab8e7b796a9e9a25aa

SHA256
21a09f496350f32aa6b6d074b4fd94f84927c315504326a5e2531d78230a0d13

SHA512
b95dbe2f0e51c23a699c5863d9add2ff1c4e33f5e10eb95d63974d91544642fe78f16140106f2272068bcc7eeaafca01c0a480f690320ee557b29fadae6b1417

Download Submit
C:\Users\Admin\AppData\Roaming\XClient.exe
Filesize
39KB

MD5
7574843f91261ab512b368ce7942d6ae

SHA1
901ad41ebcf742e242f0628f8aa5570edc0999b5

SHA256
c826d38990051067a23d7ced76e20925ec47749e562ef718029ff06555680b5b

SHA512
0ae4db524ea03ef2f3b74c60dbe772d69d733392ae78705d13d27a9ebe5cd8b6ee9d9ba51bc0d59980a0922730f8930ffbf246e735e53abb52a2910f52d838cb

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2240-1-0x0000000000BD0000-0x0000000000BE0000-memory.dmp

Filesize
64KB

Download
memory/2240-37-0x000000001AA50000-0x000000001AAD0000-memory.dmp

Filesize
512KB

Download
memory/2240-0-0x000007FEF5433000-0x000007FEF5434000-memory.dmp

Filesize
4KB

Download
memory/2240-32-0x000007FEF5433000-0x000007FEF5434000-memory.dmp

Filesize
4KB

Download
memory/2240-31-0x000000001AA50000-0x000000001AAD0000-memory.dmp

Filesize
512KB

Download
memory/2268-36-0x00000000011F0000-0x0000000001200000-memory.dmp

Filesize
64KB

Download
memory/2720-40-0x0000000000140000-0x0000000000150000-memory.dmp

Filesize
64KB

Download
memory/2800-15-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/2800-14-0x000000001B570000-0x000000001B852000-memory.dmp

Filesize
2.9MB

Download
memory/2884-8-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/2884-7-0x000000001B4C0000-0x000000001B7A2000-memory.dmp

Filesize
2.9MB

Download
memory/2884-6-0x0000000002C60000-0x0000000002CE0000-memory.dmp

Filesize
512KB

Download
memory/3036-42-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download