#xworm_160824

#IOC #OptiData #VR #xworm #RAT #powershell #RegSvcs

https://pastebin.com/CRjUiGHd

previous_contact:
n/a

FAQ:
https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

attack_vector
--------------
email attach .zip > .pdf.lnk > powershell get .pdf & .dll > rundll32 > inject RegSvcs.exe > C2

# # # # # # # #
email_headers
# # # # # # # #
Date: 15 Aug 2024 17:36:08 -0700
From: Elena Cristea <purchase _ozraltd @outlook _com>
Subject: PO from Start Group S.R.L
Received: from siemenx _com ([142 _171 _186 _184])
Received: from ip139 _ip -51 -255 -152 _eu ([51 _255 _152 _139])
Message-ID: <20240815173608 _D87B0CB345B7901F @outlook _com>

# # # # # # # #
files
# # # # # # # #
SHA-256		    cd76f454f2ddac4e0abdfb85d3d8c287e5784c147db255c84fc0f5a41c83250d
File name	    PO20240815.zip
File size	    1.00 KB (1028 bytes)

SHA-256		    c1ac6640bb74438f7a6c430ab4c701f7daf2117b87522f9bb4b8da6fdca1b375
File name	    PO20240815.pdf.lnk
File size	    3.48 KB (3568 bytes)

SHA-256		    1cc81f71eae826c2876bf8a08c2ef9ca5fe8f10ce9d4790a22fa61570e08286c
File name	    172373910590741.png [Statement_of_Account.pdf] > decoy
File size	    20.39 KB (20881 bytes)

SHA-256		    cf0cdb7290a6637aad0141025ea90332763e69bcada23eec84cf8e81faf53087
File name	    172373704210952.png [license.txt] > DLL
File size	    399.89 KB (409488 bytes)


# # # # # # # #
activity
# # # # # # # #

PL_SCR          cutt _ly /kevGcUyk >> ima _dzgsm _com /uploads /172373704210952.png   > DLL

C2              C2 xwram1 _duckdns _org :58345


netwrk
--------------
104 _22 _0 _232		    cutt _ly	        443	TLSv1.3	Client Hello (SNI=cutt _ly)
54 _36 _173 _156		ima _dzgsm _com	    443	TLSv1.3	Client Hello (SNI=ima _dzgsm _com)

comp
--------------
powershell.exe  104 _22 _0 _232
powershell.exe  54 _36 _173 _156
rundll32.exe    54 _36 _173 _156
RegSvcs.exe     193 _187 _91 _208

proc
--------------
UNC\localhost\C$\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
	"C:\Program Files\SumatraPDF\SumatraPDF.exe" "C:\Users\Public\Documents\Statement_of_Account.pdf"
	"C:\Windows\System32\rundll32.exe" C:\Users\Public\Downloads\license.txt,IEX
	C:\Windows\System32\cmd.exe /c copy C:\Users\Public\Downloads\license.txt C:\Users\%username%\AppData\Roaming\Templates
	C:\Windows\System32\cmd.exe /c copy C:\Users\Public\Downloads\cryptbase.dll C:\Users\%username%\AppData\Roaming\Templates
	C:\Windows\System32\cmd.exe /c copy C:\Users\Public\Downloads\RemoteAppLogonApplication.exe C:\Users\%username%\AppData\Roaming\Templates
	C:\Windows\System32\cmd.exe /c copy C:\Users\%username%\AppData\Local\Temp\license.txt C:\Users\%username%\AppData\Roaming\Templates
	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

persist
--------------
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
RtkAudUService		C:\Users\User01\AppData\Roaming\Templates\license.txt	Sat Aug 17 14:58:16 2024

drop
--------------
C:\Users\Public\Documents\Statement_of_Account.pdf
C:\Users\Public\Downloads\license.txt

# # # # # # # #
additional info
# # # # # # # #
n/a

# # # # # # # #
VT & Intezer
# # # # # # # #
https://www.virustotal.com/gui/file/cd76f454f2ddac4e0abdfb85d3d8c287e5784c147db255c84fc0f5a41c83250d/details
https://www.virustotal.com/gui/file/c1ac6640bb74438f7a6c430ab4c701f7daf2117b87522f9bb4b8da6fdca1b375/details
https://www.virustotal.com/gui/file/1cc81f71eae826c2876bf8a08c2ef9ca5fe8f10ce9d4790a22fa61570e08286c/details
https://www.virustotal.com/gui/file/cf0cdb7290a6637aad0141025ea90332763e69bcada23eec84cf8e81faf53087/details

VR