xworm | 1731919d2dc81ad27833aaaf162c923c8c0e9ec12f0517c7db0409b74e9550c6

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 18:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zvgfd-main/Fanta.Live.exe
Size

79KB
MD5

a378eb40a60e9a4fb826d90b919dbc34
SHA1

46921006940cda5096b30e0788a5c8e4bddb9137
SHA256

356643a10605dba3e7497cb2cbc586951d99dcb95e9fa8a64b65a6fe4d874ef6
SHA512

2a73b843c3f8c508ead9e8fb73a2f1231d0f0cdc6a483e48a403f891710b9c94e79fca9be499f857a0a7a8189b056464d0e1d37ddae22704951dab66ab719505
SSDEEP

1536:ynOPvOn3Dxn2xpP+EnGlDRXxWO2jCt+htJ5bGr9VMKO/6IO27Ecdo9JfBFKn:yOPozl2xpsx+hxbGpqKOxOSEcdoTXKn

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

super-nearest.gl.at.ply.gg:17835

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource yara_rule

behavioral19/memory/2756-1-0x0000000000870000-0x000000000088A000-memory.dmp family_xworm
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2688 powershell.exe
2640 powershell.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exepowershell.exeFanta.Live.exe

pid process

2688 powershell.exe
2640 powershell.exe
2756 Fanta.Live.exe
Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

Fanta.Live.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2756 Fanta.Live.exe
Token: SeDebugPrivilege 2688 powershell.exe
Token: SeDebugPrivilege 2640 powershell.exe
Token: SeDebugPrivilege 2756 Fanta.Live.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Fanta.Live.exe

pid process

2756 Fanta.Live.exe

resource	yara_rule
behavioral19/memory/2756-1-0x0000000000870000-0x000000000088A000-memory.dmp	family_xworm

pid	process
2688	powershell.exe
2640	powershell.exe

flow	ioc
4	ip-api.com

pid	process
2688	powershell.exe
2640	powershell.exe
2756	Fanta.Live.exe

description	pid	process
Token: SeDebugPrivilege	2756	Fanta.Live.exe
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	2640	powershell.exe
Token: SeDebugPrivilege	2756	Fanta.Live.exe

pid	process
2756	Fanta.Live.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

Fanta.Live.exe

description	pid	process	target process
PID 2756 wrote to memory of 2688	2756	Fanta.Live.exe	powershell.exe
PID 2756 wrote to memory of 2688	2756	Fanta.Live.exe	powershell.exe
PID 2756 wrote to memory of 2688	2756	Fanta.Live.exe	powershell.exe
PID 2756 wrote to memory of 2640	2756	Fanta.Live.exe	powershell.exe
PID 2756 wrote to memory of 2640	2756	Fanta.Live.exe	powershell.exe
PID 2756 wrote to memory of 2640	2756	Fanta.Live.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Fanta.Live.exe
"C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Fanta.Live.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Fanta.Live.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Fanta.Live.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2640

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\FEJXQEDRK996UGJ8PL65.temp
Filesize
7KB

MD5
115c472defce54ab8fe2503c3f52b52b

SHA1
4ecbd6b5e6a14a81f7e5b524b3d27171dc80dc7c

SHA256
3f310043809952feac3cfd4d5625078d860107eb505203137b8137637c98153e

SHA512
8643f43b65b5c24d80410b30404a1b212ba0302f9cadfd0d28c975bd723e56b9cf30cd6ffce9588a7774ed87aedb4dce44cc2089ee275639c7df14c404f4c70b

Download Submit
memory/2640-15-0x000000001B7A0000-0x000000001BA82000-memory.dmp

Filesize
2.9MB

Download
memory/2640-16-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/2688-7-0x00000000028C0000-0x0000000002940000-memory.dmp

Filesize
512KB

Download
memory/2688-8-0x000000001B4C0000-0x000000001B7A2000-memory.dmp

Filesize
2.9MB

Download
memory/2688-9-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/2756-0-0x000007FEF6053000-0x000007FEF6054000-memory.dmp

Filesize
4KB

Download
memory/2756-1-0x0000000000870000-0x000000000088A000-memory.dmp

Filesize
104KB

Download
memory/2756-2-0x000007FEF6050000-0x000007FEF6A3C000-memory.dmp

Filesize
9.9MB

Download
memory/2756-17-0x000007FEF6053000-0x000007FEF6054000-memory.dmp

Filesize
4KB

Download
memory/2756-18-0x000007FEF6050000-0x000007FEF6A3C000-memory.dmp

Filesize
9.9MB

Download