xworm | 99bf031f23b1759702a56ccfc9425f0a063654dcc4a94d8feeb89792c82f3082

Analysis

max time kernel
118s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 12:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fix.exe
Size

35KB
MD5

83bbe29b99a54bad48074efb72ce1fcc
SHA1

421deeba13130a8eebacc8c7f48f28e6fe8485f2
SHA256

99bf031f23b1759702a56ccfc9425f0a063654dcc4a94d8feeb89792c82f3082
SHA512

67fe2ac907c297cd3c4d1af7f80257b468bc4e73cab428568ea1238d41cd8c43262765a0b0d43b2accb003901a66e9e7ec162fefda2fd89040697e1e168ac27f
SSDEEP

768:ChiLce92aOrsQiUy5FyS9ZL6LOjhibold:ChkceWsQi5FT9ZL6LOjGo7

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

20.ip.gl.ply.gg:53765

Mutex

JCfj6Aifpywc6Ul9

Attributes

Install_directory
%AppData%
install_file
svchost.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/2044-1-0x0000000000090000-0x00000000000A0000-memory.dmp family_xworm
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

1300 powershell.exe
2548 powershell.exe
2776 powershell.exe
2684 powershell.exe

resource	yara_rule
behavioral1/memory/2044-1-0x0000000000090000-0x00000000000A0000-memory.dmp	family_xworm

pid	process
1300	powershell.exe
2548	powershell.exe
2776	powershell.exe
2684	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

fix.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	fix.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

2776 powershell.exe
2684 powershell.exe
1300 powershell.exe
2548 powershell.exe

pid	process
2776	powershell.exe
2684	powershell.exe
1300	powershell.exe
2548	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

fix.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2044	fix.exe
Token: SeDebugPrivilege	2776	powershell.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeDebugPrivilege	1300	powershell.exe
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeDebugPrivilege	2044	fix.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

fix.exe

description	pid	process	target process
PID 2044 wrote to memory of 2776	2044	fix.exe	powershell.exe
PID 2044 wrote to memory of 2776	2044	fix.exe	powershell.exe
PID 2044 wrote to memory of 2776	2044	fix.exe	powershell.exe
PID 2044 wrote to memory of 2684	2044	fix.exe	powershell.exe
PID 2044 wrote to memory of 2684	2044	fix.exe	powershell.exe
PID 2044 wrote to memory of 2684	2044	fix.exe	powershell.exe
PID 2044 wrote to memory of 1300	2044	fix.exe	powershell.exe
PID 2044 wrote to memory of 1300	2044	fix.exe	powershell.exe
PID 2044 wrote to memory of 1300	2044	fix.exe	powershell.exe
PID 2044 wrote to memory of 2548	2044	fix.exe	powershell.exe
PID 2044 wrote to memory of 2548	2044	fix.exe	powershell.exe
PID 2044 wrote to memory of 2548	2044	fix.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\fix.exe
"C:\Users\Admin\AppData\Local\Temp\fix.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\fix.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2776

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'fix.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2684

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1300

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2548

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
17c2be3bcd13a3418e2b8fd123c75d8d

SHA1
aaef002ab54f9ca0e72ee99b948cccdaa00a1413

SHA256
fdcdceb8adbda48d2d13b74d2579327201f017f5c42ff0842b1896a8e3177876

SHA512
89ed05db436e0cc1a3b0522ffc277ccff8d6e3572bb234ffec4bd1c2c28943cd4805c16ce0c71e2933375d38b91cd4f351d5fe89866788ace4b65e40d68e46a3

Download Submit
memory/2044-0-0x000007FEF5203000-0x000007FEF5204000-memory.dmp

Filesize
4KB

Download
memory/2044-1-0x0000000000090000-0x00000000000A0000-memory.dmp

Filesize
64KB

Download
memory/2044-27-0x000000001AF20000-0x000000001AFA0000-memory.dmp

Filesize
512KB

Download
memory/2044-28-0x000007FEF5203000-0x000007FEF5204000-memory.dmp

Filesize
4KB

Download
memory/2044-29-0x000000001AF20000-0x000000001AFA0000-memory.dmp

Filesize
512KB

Download
memory/2044-30-0x0000000002140000-0x000000000214A000-memory.dmp

Filesize
40KB

Download
memory/2684-14-0x000000001B7E0000-0x000000001BAC2000-memory.dmp

Filesize
2.9MB

Download
memory/2684-15-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download
memory/2776-6-0x0000000002E20000-0x0000000002EA0000-memory.dmp

Filesize
512KB

Download
memory/2776-7-0x000000001B7F0000-0x000000001BAD2000-memory.dmp

Filesize
2.9MB

Download
memory/2776-8-0x0000000002760000-0x0000000002768000-memory.dmp

Filesize
32KB

Download