xworm | 6d5ff2230c713e9372d23989c3ea247d814ffc6f19380be86f7bccf3c0b6ff91

Analysis

max time kernel
144s
max time network
146s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 04:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WaveWindowsCracked.exe
Size

7.6MB
MD5

1aec1baab610e71d2dd83ddb08d9c49a
SHA1

47789c92be6ce830faa926acb1969086d410e4d4
SHA256

e2bfe1a9a590aab1f7572309b45c0cf88558f9c3463acb550d30e24f47132d1c
SHA512

2435a57bd91dae06c62ca1d209091f3ce4f3de9012eb80b901e89a62e60b28d45e5c94d018c5af5a831b3ff8d28e4bfc6e0c487125be14926a62b970e459690a
SSDEEP

196608:IUhZUvqevevx2QtiFX2PTiiXIeMeZ4SZCqL1:BhOvaZ+X2PG6Iep6SZCy

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

stewiegriffin-37537.portmap.host:37537

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Detect Xworm Payload 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\DriverUpdt.exe	family_xworm
behavioral5/memory/3012-13-0x0000000001230000-0x000000000124C000-memory.dmp	family_xworm
behavioral5/memory/1224-54-0x00000000001B0000-0x00000000001CC000-memory.dmp	family_xworm
behavioral5/memory/2668-57-0x0000000000E70000-0x0000000000E8C000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

2480 powershell.exe
2080 powershell.exe
1936 powershell.exe
2204 powershell.exe

pid	process
2480	powershell.exe
2080	powershell.exe
1936	powershell.exe
2204	powershell.exe

Drops startup file 2 IoCs

Processes:

DriverUpdt.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DriverUpdt.lnk	DriverUpdt.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DriverUpdt.lnk	DriverUpdt.exe

Executes dropped EXE 4 IoCs

Processes:

WaveWindows.exeDriverUpdt.exeDriverUpdtDriverUpdt

pid process

2680 WaveWindows.exe
3012 DriverUpdt.exe
1224 DriverUpdt
2668 DriverUpdt

pid	process
2680	WaveWindows.exe
3012	DriverUpdt.exe
1224	DriverUpdt
2668	DriverUpdt

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

DriverUpdt.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\DriverUpdt = "C:\\Users\\Admin\\AppData\\Roaming\\DriverUpdt"	DriverUpdt.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

396 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

WaveWindows.exepowershell.exepowershell.exepowershell.exepowershell.exeDriverUpdt.exe

pid process

2680 WaveWindows.exe
2480 powershell.exe
2080 powershell.exe
1936 powershell.exe
2204 powershell.exe
3012 DriverUpdt.exe

flow	ioc
4	ip-api.com

pid	process
396	schtasks.exe

pid	process
2680	WaveWindows.exe
2480	powershell.exe
2080	powershell.exe
1936	powershell.exe
2204	powershell.exe
3012	DriverUpdt.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

DriverUpdt.exeWaveWindows.exepowershell.exepowershell.exepowershell.exepowershell.exeDriverUpdtDriverUpdt

description	pid	process
Token: SeDebugPrivilege	3012	DriverUpdt.exe
Token: SeDebugPrivilege	2680	WaveWindows.exe
Token: SeDebugPrivilege	2480	powershell.exe
Token: SeDebugPrivilege	2080	powershell.exe
Token: SeDebugPrivilege	1936	powershell.exe
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeDebugPrivilege	3012	DriverUpdt.exe
Token: SeDebugPrivilege	1224	DriverUpdt
Token: SeDebugPrivilege	2668	DriverUpdt

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

DriverUpdt.exe

pid process

3012 DriverUpdt.exe

pid	process
3012	DriverUpdt.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

WaveWindowsCracked.exeDriverUpdt.exetaskeng.exe

description	pid	process	target process
PID 1616 wrote to memory of 2680	1616	WaveWindowsCracked.exe	WaveWindows.exe
PID 1616 wrote to memory of 2680	1616	WaveWindowsCracked.exe	WaveWindows.exe
PID 1616 wrote to memory of 2680	1616	WaveWindowsCracked.exe	WaveWindows.exe
PID 1616 wrote to memory of 2680	1616	WaveWindowsCracked.exe	WaveWindows.exe
PID 1616 wrote to memory of 3012	1616	WaveWindowsCracked.exe	DriverUpdt.exe
PID 1616 wrote to memory of 3012	1616	WaveWindowsCracked.exe	DriverUpdt.exe
PID 1616 wrote to memory of 3012	1616	WaveWindowsCracked.exe	DriverUpdt.exe
PID 3012 wrote to memory of 2480	3012	DriverUpdt.exe	powershell.exe
PID 3012 wrote to memory of 2480	3012	DriverUpdt.exe	powershell.exe
PID 3012 wrote to memory of 2480	3012	DriverUpdt.exe	powershell.exe
PID 3012 wrote to memory of 2080	3012	DriverUpdt.exe	powershell.exe
PID 3012 wrote to memory of 2080	3012	DriverUpdt.exe	powershell.exe
PID 3012 wrote to memory of 2080	3012	DriverUpdt.exe	powershell.exe
PID 3012 wrote to memory of 1936	3012	DriverUpdt.exe	powershell.exe
PID 3012 wrote to memory of 1936	3012	DriverUpdt.exe	powershell.exe
PID 3012 wrote to memory of 1936	3012	DriverUpdt.exe	powershell.exe
PID 3012 wrote to memory of 2204	3012	DriverUpdt.exe	powershell.exe
PID 3012 wrote to memory of 2204	3012	DriverUpdt.exe	powershell.exe
PID 3012 wrote to memory of 2204	3012	DriverUpdt.exe	powershell.exe
PID 3012 wrote to memory of 396	3012	DriverUpdt.exe	schtasks.exe
PID 3012 wrote to memory of 396	3012	DriverUpdt.exe	schtasks.exe
PID 3012 wrote to memory of 396	3012	DriverUpdt.exe	schtasks.exe
PID 2472 wrote to memory of 1224	2472	taskeng.exe	DriverUpdt
PID 2472 wrote to memory of 1224	2472	taskeng.exe	DriverUpdt
PID 2472 wrote to memory of 1224	2472	taskeng.exe	DriverUpdt
PID 2472 wrote to memory of 2668	2472	taskeng.exe	DriverUpdt
PID 2472 wrote to memory of 2668	2472	taskeng.exe	DriverUpdt
PID 2472 wrote to memory of 2668	2472	taskeng.exe	DriverUpdt

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\WaveWindowsCracked.exe
"C:\Users\Admin\AppData\Local\Temp\WaveWindowsCracked.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1616

C:\Users\Admin\AppData\Roaming\WaveWindows.exe
"C:\Users\Admin\AppData\Roaming\WaveWindows.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2680

C:\Users\Admin\AppData\Roaming\DriverUpdt.exe
"C:\Users\Admin\AppData\Roaming\DriverUpdt.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\DriverUpdt.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2480

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'DriverUpdt.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2080

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\DriverUpdt'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1936

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'DriverUpdt'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2204

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "DriverUpdt" /tr "C:\Users\Admin\AppData\Roaming\DriverUpdt"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:396

C:\Windows\system32\taskeng.exe
taskeng.exe {C5FABA5C-6BF4-4042-8537-5BC10BCFAB83} S-1-5-21-3691908287-3775019229-3534252667-1000:UOTHCPHQ\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2472

C:\Users\Admin\AppData\Roaming\DriverUpdt
C:\Users\Admin\AppData\Roaming\DriverUpdt
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1224

C:\Users\Admin\AppData\Roaming\DriverUpdt
C:\Users\Admin\AppData\Roaming\DriverUpdt
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2668

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\DriverUpdt.exe
Filesize
84KB

MD5
65485b0475b6c8a3b4f35bba541938a6

SHA1
28e6e6cd2ebf8a9fdffeb4aeba13b70ea7ea03a3

SHA256
c6740ee5c8afdc2c7be42fb03ab5a346925efc6ac785fe7d68dec2d5f05d276b

SHA512
034303ee48132b80da79e54a6077676cfd436ef869493a11a27c29dc7cb730fd2ce902320d554a0cde81fc0a06f6c56efa5c170a1360906ec9fa7fd101c3706d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
b783ac0b28ee1ff8f481b8afc3c7f9d3

SHA1
1958c6ebfa871bf25f31ce830caefaf58bb5c1c6

SHA256
2f22027808e5a1fc3af39b91ee25d336d01bb61c1035785aefd441ec8727041d

SHA512
1acbb29791a963323aeaf8ca8a4f6b6ad0c0a331ff828ce0c2db9f900d90ae5b9b20210437b66c99874ea9958cc0f67e9cbe6a3cea262790585870150fc3dcb5

Download Submit
C:\Users\Admin\AppData\Roaming\WaveWindows.exe
Filesize
7.5MB

MD5
cd34bf9c69f229818a4c9301e51435eb

SHA1
bfb95a5dc5d777e2b5940f354da271fed397adb2

SHA256
3b217daf815ced5cf1087d1f408fc3833c9d80a1e3e25b3f9041698b9e34216f

SHA512
2c68b211a4c8c144713cbe99214e8dc33d3ef6c1f244af4a313ff5ab93d946a4281d404b02c5f66ef5652071279649082877eaa728912a0e769c2c848e0a8e6b

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1224-54-0x00000000001B0000-0x00000000001CC000-memory.dmp

Filesize
112KB

Download
memory/1616-1-0x0000000001380000-0x0000000001B26000-memory.dmp

Filesize
7.6MB

Download
memory/1616-0-0x000007FEF6163000-0x000007FEF6164000-memory.dmp

Filesize
4KB

Download
memory/1936-37-0x000000001B6B0000-0x000000001B992000-memory.dmp

Filesize
2.9MB

Download
memory/1936-38-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/2080-30-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

Filesize
2.9MB

Download
memory/2080-31-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download
memory/2204-46-0x00000000029F0000-0x00000000029F8000-memory.dmp

Filesize
32KB

Download
memory/2204-45-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/2480-24-0x0000000001E00000-0x0000000001E08000-memory.dmp

Filesize
32KB

Download
memory/2480-23-0x000000001B600000-0x000000001B8E2000-memory.dmp

Filesize
2.9MB

Download
memory/2668-57-0x0000000000E70000-0x0000000000E8C000-memory.dmp

Filesize
112KB

Download
memory/2680-18-0x0000000005480000-0x0000000005566000-memory.dmp

Filesize
920KB

Download
memory/2680-17-0x0000000000760000-0x0000000000784000-memory.dmp

Filesize
144KB

Download
memory/2680-16-0x00000000007C0000-0x000000000080A000-memory.dmp

Filesize
296KB

Download
memory/2680-14-0x0000000000890000-0x000000000101C000-memory.dmp

Filesize
7.5MB

Download
memory/3012-15-0x000007FEF6160000-0x000007FEF6B4C000-memory.dmp

Filesize
9.9MB

Download
memory/3012-50-0x000007FEF6160000-0x000007FEF6B4C000-memory.dmp

Filesize
9.9MB

Download
memory/3012-13-0x0000000001230000-0x000000000124C000-memory.dmp

Filesize
112KB

Download