xworm | a5728f8fd33c77818782d3eef567b77d1586b1927696affced63d494691edbe6

Analysis

max time kernel
34s
max time network
36s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 11:13

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

sv.exe
Size

63KB
MD5

c095a62b525e62244cad230e696028cf
SHA1

67232c186d3efe248b540f1f2fe3382770b5074a
SHA256

a5728f8fd33c77818782d3eef567b77d1586b1927696affced63d494691edbe6
SHA512

5ba859d89a9277d9b6243f461991cc6472d001cdea52d9fcfba3cbead88fbc69d9dfce076b1fdeaf0d1cd21fe4cace54f1cefe1c352d70cc8fa2898fe1b61fb0
SSDEEP

1536:unjFXblMp3wgDkbivVSm16KTOKjLIJXc:unrAwgDkbicmbOKj0JM

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

amount-acceptance.gl.at.ply.gg:7420

Attributes

Install_directory
%ProgramData%
install_file
svhost.exe

Signatures

Detect Xworm Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1800-1-0x0000000000A20000-0x0000000000A36000-memory.dmp	family_xworm
C:\ProgramData\svhost.exe	family_xworm
behavioral1/memory/1932-37-0x0000000001000000-0x0000000001016000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

1192 powershell.exe
2644 powershell.exe
2720 powershell.exe
2560 powershell.exe

pid	process
1192	powershell.exe
2644	powershell.exe
2720	powershell.exe
2560	powershell.exe

Drops startup file 2 IoCs

Processes:

sv.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk	sv.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk	sv.exe

Executes dropped EXE 2 IoCs

Processes:

svhost.exeqpcaih.exe

pid process

1932 svhost.exe
2756 qpcaih.exe
Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Processes:

sv.exe

description ioc process

Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\ProgramData\\svhost.exe" sv.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2512 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

1192 powershell.exe
2644 powershell.exe
2720 powershell.exe
2560 powershell.exe

pid	process
1932	svhost.exe
2756	qpcaih.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\ProgramData\\svhost.exe"	sv.exe

pid	process
2512	schtasks.exe

pid	process
1192	powershell.exe
2644	powershell.exe
2720	powershell.exe
2560	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

sv.exepowershell.exepowershell.exepowershell.exepowershell.exesvhost.exeshutdown.exe

description	pid	process
Token: SeDebugPrivilege	1800	sv.exe
Token: SeDebugPrivilege	1192	powershell.exe
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeDebugPrivilege	2720	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeDebugPrivilege	1800	sv.exe
Token: SeDebugPrivilege	1932	svhost.exe
Token: SeShutdownPrivilege	2052	shutdown.exe
Token: SeRemoteShutdownPrivilege	2052	shutdown.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

sv.exetaskeng.execmd.exe

description	pid	process	target process
PID 1800 wrote to memory of 1192	1800	sv.exe	powershell.exe
PID 1800 wrote to memory of 1192	1800	sv.exe	powershell.exe
PID 1800 wrote to memory of 1192	1800	sv.exe	powershell.exe
PID 1800 wrote to memory of 2644	1800	sv.exe	powershell.exe
PID 1800 wrote to memory of 2644	1800	sv.exe	powershell.exe
PID 1800 wrote to memory of 2644	1800	sv.exe	powershell.exe
PID 1800 wrote to memory of 2720	1800	sv.exe	powershell.exe
PID 1800 wrote to memory of 2720	1800	sv.exe	powershell.exe
PID 1800 wrote to memory of 2720	1800	sv.exe	powershell.exe
PID 1800 wrote to memory of 2560	1800	sv.exe	powershell.exe
PID 1800 wrote to memory of 2560	1800	sv.exe	powershell.exe
PID 1800 wrote to memory of 2560	1800	sv.exe	powershell.exe
PID 1800 wrote to memory of 2512	1800	sv.exe	schtasks.exe
PID 1800 wrote to memory of 2512	1800	sv.exe	schtasks.exe
PID 1800 wrote to memory of 2512	1800	sv.exe	schtasks.exe
PID 1924 wrote to memory of 1932	1924	taskeng.exe	svhost.exe
PID 1924 wrote to memory of 1932	1924	taskeng.exe	svhost.exe
PID 1924 wrote to memory of 1932	1924	taskeng.exe	svhost.exe
PID 1800 wrote to memory of 864	1800	sv.exe	cmd.exe
PID 1800 wrote to memory of 864	1800	sv.exe	cmd.exe
PID 1800 wrote to memory of 864	1800	sv.exe	cmd.exe
PID 864 wrote to memory of 2052	864	cmd.exe	shutdown.exe
PID 864 wrote to memory of 2052	864	cmd.exe	shutdown.exe
PID 864 wrote to memory of 2052	864	cmd.exe	shutdown.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\sv.exe
"C:\Users\Admin\AppData\Local\Temp\sv.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sv.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1192

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sv.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2644

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svhost.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2720

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2560

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svhost" /tr "C:\ProgramData\svhost.exe"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2512

C:\Users\Admin\AppData\Local\Temp\qpcaih.exe
"C:\Users\Admin\AppData\Local\Temp\qpcaih.exe"
2⤵
- Executes dropped EXE
PID:2756

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\rowywa.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:864

C:\Windows\system32\shutdown.exe
shutdown -r -t 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2052

C:\Windows\system32\taskeng.exe
taskeng.exe {04516FF2-68A1-4919-B026-0965FEAFB1A2} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1924

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1932

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2056

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2276

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\svhost.exe
Filesize
63KB

MD5
c095a62b525e62244cad230e696028cf

SHA1
67232c186d3efe248b540f1f2fe3382770b5074a

SHA256
a5728f8fd33c77818782d3eef567b77d1586b1927696affced63d494691edbe6

SHA512
5ba859d89a9277d9b6243f461991cc6472d001cdea52d9fcfba3cbead88fbc69d9dfce076b1fdeaf0d1cd21fe4cace54f1cefe1c352d70cc8fa2898fe1b61fb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\qpcaih.exe
Filesize
8.0MB

MD5
780d9df36221ccd24716da39ee3e2708

SHA1
3a2e4f8bc401856f1870e9fd3a3977044db68729

SHA256
f765d1d4012f47223a47c5992da55066e81d76b0714eb347ca6a54c55f4e374c

SHA512
36b1df97a9b0a3ae9cae704f722537c877c6b8a091c513be66bd16645cdf9ab424912e6dac3ddfbbf9419a9d0acc17113dec88418b8134e641a87028e8e4d6c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\rowywa.bat
Filesize
49B

MD5
e3f95e49eb2d528bba6a694925bbc6a6

SHA1
905d649872a38830613e8166e5293241282615f3

SHA256
db7b2c01bf51af551dc58ed70cb3515193baa972771fbb91cbf55f9d2e1eedf5

SHA512
766567d1d64c3b6edc7d4060a3c43d193f09a8d3ceb41d33d6b3dc82eab23be1547acd3aba331f64398f81b7b8510d88fd6cdfc5801212ce24bad1bfdea16d8e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
38df3f7b6c7958f8352deb6d655a1a67

SHA1
7056e86b1769efc8ecc0044b02c3db63e07230df

SHA256
364b54425c2c30a4cca4b559f4768274739d1afce7937c58b0c7438d94737517

SHA512
5fd04982dd18a2023170aca820ee5f0b0e7b5793f2ca04384e4f231289d6094aeceea63e5b9b769c17b0a8f9c0153e3513bcdefe0c09321064fe06133c457dbc

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1192-8-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/1192-7-0x000000001B5A0000-0x000000001B882000-memory.dmp

Filesize
2.9MB

Download
memory/1192-6-0x0000000002A60000-0x0000000002AE0000-memory.dmp

Filesize
512KB

Download
memory/1800-0-0x000007FEF50D3000-0x000007FEF50D4000-memory.dmp

Filesize
4KB

Download
memory/1800-31-0x000000001B390000-0x000000001B410000-memory.dmp

Filesize
512KB

Download
memory/1800-32-0x000007FEF50D3000-0x000007FEF50D4000-memory.dmp

Filesize
4KB

Download
memory/1800-41-0x000000001B390000-0x000000001B410000-memory.dmp

Filesize
512KB

Download
memory/1800-1-0x0000000000A20000-0x0000000000A36000-memory.dmp

Filesize
88KB

Download
memory/1932-37-0x0000000001000000-0x0000000001016000-memory.dmp

Filesize
88KB

Download
memory/2644-14-0x000000001B750000-0x000000001BA32000-memory.dmp

Filesize
2.9MB

Download
memory/2644-15-0x0000000001E10000-0x0000000001E18000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads