xworm | 99bf031f23b1759702a56ccfc9425f0a063654dcc4a94d8feeb89792c82f3082

Resubmissions

01-07-2024 12:05

240701-n9bt2s1akf 10

01-07-2024 11:59

240701-n5w97atdqr 10

Analysis

max time kernel
230s
max time network
234s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
01-07-2024 12:05

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

fix.exe
Size

35KB
MD5

83bbe29b99a54bad48074efb72ce1fcc
SHA1

421deeba13130a8eebacc8c7f48f28e6fe8485f2
SHA256

99bf031f23b1759702a56ccfc9425f0a063654dcc4a94d8feeb89792c82f3082
SHA512

67fe2ac907c297cd3c4d1af7f80257b468bc4e73cab428568ea1238d41cd8c43262765a0b0d43b2accb003901a66e9e7ec162fefda2fd89040697e1e168ac27f
SSDEEP

768:ChiLce92aOrsQiUy5FyS9ZL6LOjhibold:ChkceWsQi5FT9ZL6LOjGo7

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

20.ip.gl.ply.gg:53765

Mutex

JCfj6Aifpywc6Ul9

Attributes

Install_directory
%AppData%
install_file
svchost.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource yara_rule

behavioral3/memory/204-1-0x0000000000F30000-0x0000000000F40000-memory.dmp family_xworm
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

2372 powershell.exe
3576 powershell.exe
4508 powershell.exe
4724 powershell.exe

resource	yara_rule
behavioral3/memory/204-1-0x0000000000F30000-0x0000000000F40000-memory.dmp	family_xworm

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

fix.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	fix.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid	process
2372	powershell.exe
2372	powershell.exe
2372	powershell.exe
3576	powershell.exe
3576	powershell.exe
3576	powershell.exe
4508	powershell.exe
4508	powershell.exe
4508	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

fix.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	204	fix.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeIncreaseQuotaPrivilege	2372	powershell.exe
Token: SeSecurityPrivilege	2372	powershell.exe
Token: SeTakeOwnershipPrivilege	2372	powershell.exe
Token: SeLoadDriverPrivilege	2372	powershell.exe
Token: SeSystemProfilePrivilege	2372	powershell.exe
Token: SeSystemtimePrivilege	2372	powershell.exe
Token: SeProfSingleProcessPrivilege	2372	powershell.exe
Token: SeIncBasePriorityPrivilege	2372	powershell.exe
Token: SeCreatePagefilePrivilege	2372	powershell.exe
Token: SeBackupPrivilege	2372	powershell.exe
Token: SeRestorePrivilege	2372	powershell.exe
Token: SeShutdownPrivilege	2372	powershell.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeSystemEnvironmentPrivilege	2372	powershell.exe
Token: SeRemoteShutdownPrivilege	2372	powershell.exe
Token: SeUndockPrivilege	2372	powershell.exe
Token: SeManageVolumePrivilege	2372	powershell.exe
Token: 33	2372	powershell.exe
Token: 34	2372	powershell.exe
Token: 35	2372	powershell.exe
Token: 36	2372	powershell.exe
Token: SeDebugPrivilege	3576	powershell.exe
Token: SeIncreaseQuotaPrivilege	3576	powershell.exe
Token: SeSecurityPrivilege	3576	powershell.exe
Token: SeTakeOwnershipPrivilege	3576	powershell.exe
Token: SeLoadDriverPrivilege	3576	powershell.exe
Token: SeSystemProfilePrivilege	3576	powershell.exe
Token: SeSystemtimePrivilege	3576	powershell.exe
Token: SeProfSingleProcessPrivilege	3576	powershell.exe
Token: SeIncBasePriorityPrivilege	3576	powershell.exe
Token: SeCreatePagefilePrivilege	3576	powershell.exe
Token: SeBackupPrivilege	3576	powershell.exe
Token: SeRestorePrivilege	3576	powershell.exe
Token: SeShutdownPrivilege	3576	powershell.exe
Token: SeDebugPrivilege	3576	powershell.exe
Token: SeSystemEnvironmentPrivilege	3576	powershell.exe
Token: SeRemoteShutdownPrivilege	3576	powershell.exe
Token: SeUndockPrivilege	3576	powershell.exe
Token: SeManageVolumePrivilege	3576	powershell.exe
Token: 33	3576	powershell.exe
Token: 34	3576	powershell.exe
Token: 35	3576	powershell.exe
Token: 36	3576	powershell.exe
Token: SeDebugPrivilege	4508	powershell.exe
Token: SeIncreaseQuotaPrivilege	4508	powershell.exe
Token: SeSecurityPrivilege	4508	powershell.exe
Token: SeTakeOwnershipPrivilege	4508	powershell.exe
Token: SeLoadDriverPrivilege	4508	powershell.exe
Token: SeSystemProfilePrivilege	4508	powershell.exe
Token: SeSystemtimePrivilege	4508	powershell.exe
Token: SeProfSingleProcessPrivilege	4508	powershell.exe
Token: SeIncBasePriorityPrivilege	4508	powershell.exe
Token: SeCreatePagefilePrivilege	4508	powershell.exe
Token: SeBackupPrivilege	4508	powershell.exe
Token: SeRestorePrivilege	4508	powershell.exe
Token: SeShutdownPrivilege	4508	powershell.exe
Token: SeDebugPrivilege	4508	powershell.exe
Token: SeSystemEnvironmentPrivilege	4508	powershell.exe
Token: SeRemoteShutdownPrivilege	4508	powershell.exe
Token: SeUndockPrivilege	4508	powershell.exe
Token: SeManageVolumePrivilege	4508	powershell.exe
Token: 33	4508	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

3344 LogonUI.exe

pid	process
3344	LogonUI.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

fix.exe

description	pid	process	target process
PID 204 wrote to memory of 2372	204	fix.exe	powershell.exe
PID 204 wrote to memory of 2372	204	fix.exe	powershell.exe
PID 204 wrote to memory of 3576	204	fix.exe	powershell.exe
PID 204 wrote to memory of 3576	204	fix.exe	powershell.exe
PID 204 wrote to memory of 4508	204	fix.exe	powershell.exe
PID 204 wrote to memory of 4508	204	fix.exe	powershell.exe
PID 204 wrote to memory of 4724	204	fix.exe	powershell.exe
PID 204 wrote to memory of 4724	204	fix.exe	powershell.exe
PID 204 wrote to memory of 4292	204	fix.exe	shutdown.exe
PID 204 wrote to memory of 4292	204	fix.exe	shutdown.exe

C:\Users\Admin\AppData\Local\Temp\fix.exe
"C:\Users\Admin\AppData\Local\Temp\fix.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:204

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\fix.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2372

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'fix.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3576

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4508

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4724

C:\Windows\SYSTEM32\shutdown.exe
shutdown.exe /f /s /t 0
2⤵
PID:4292

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3aed855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3344

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
0dd991baa472b4eedd84b192247e5c17

SHA1
6747dfb038342c655b26f51fe4b2b042465969d1

SHA256
061ebf886c147e4a789b9fdc7705ef401a965afec5edd86ddd0448e6c599bd42

SHA512
a68d138949bce65356bf6dbda1bb53d053702f62e527601910fe7ebec98e8c43eecf8628b06094534e0dde28a16a5647f685038cd11ec33f251255b70d025cf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
cc8d5dd849c53ca6233dc5f30f95253e

SHA1
0b579a784d1695c48c59b798fc117496b30965c1

SHA256
580cd55037fee3f604255fd7c19f76cb62c660d95e90e39ac74d28d7fd3918e3

SHA512
2dbe5ae07690178e54c151fb75956a05fa32aaeb91c397d5c254074ea91c57a10494eec7966309ce54fb1e56285045a3d118b3f47c2860d962bfd0399732a902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
072e1c480863f9f441d3aa4e09368bc0

SHA1
0214dee9626c0425b0cd2291a0ac44c7eddfc617

SHA256
f5826e70ba4dabd99b8895e2edb21cc5ebc633864dcb708f45e1af0596c44bb5

SHA512
32f627c889731637da8ccdb00a181ba41cd6fb8d12f4520885399da4f5d21ce54c9d30699c3e2745a217af3e3d88fa81c5029f0fe26796ad0eebd24d019e7815

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qh3qj21u.see.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
memory/204-184-0x00007FFA9F7A0000-0x00007FFAA018C000-memory.dmp

Filesize
9.9MB

Download
memory/204-1-0x0000000000F30000-0x0000000000F40000-memory.dmp

Filesize
64KB

Download
memory/204-188-0x00007FFA9F7A0000-0x00007FFAA018C000-memory.dmp

Filesize
9.9MB

Download
memory/204-187-0x00007FFA9F7A0000-0x00007FFAA018C000-memory.dmp

Filesize
9.9MB

Download
memory/204-186-0x000000001BBD0000-0x000000001BBDC000-memory.dmp

Filesize
48KB

Download
memory/204-185-0x00007FFA9F7A3000-0x00007FFA9F7A4000-memory.dmp

Filesize
4KB

Download
memory/204-0-0x00007FFA9F7A3000-0x00007FFA9F7A4000-memory.dmp

Filesize
4KB

Download
memory/2372-48-0x00007FFA9F7A0000-0x00007FFAA018C000-memory.dmp

Filesize
9.9MB

Download
memory/2372-6-0x000001C5439E0000-0x000001C543A02000-memory.dmp

Filesize
136KB

Download
memory/2372-10-0x00007FFA9F7A0000-0x00007FFAA018C000-memory.dmp

Filesize
9.9MB

Download
memory/2372-9-0x000001C55C170000-0x000001C55C1E6000-memory.dmp

Filesize
472KB

Download
memory/2372-52-0x00007FFA9F7A0000-0x00007FFAA018C000-memory.dmp

Filesize
9.9MB

Download
memory/2372-11-0x00007FFA9F7A0000-0x00007FFAA018C000-memory.dmp

Filesize
9.9MB

Download
memory/2372-41-0x00007FFA9F7A0000-0x00007FFAA018C000-memory.dmp

Filesize
9.9MB

Download
memory/2372-24-0x00007FFA9F7A0000-0x00007FFAA018C000-memory.dmp

Filesize
9.9MB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads