XWorm

Overview

An employee received a phishing email and accidentally executed a malicious attachment. The sample ran silently, establishing persistence, communicating with C2 infrastructure, and deploying keylogging and USB spreading capabilities. This lab involves static and dynamic analysis of the XWorm v2 RAT sample using PEStudio, dnSpy, and Any.run.

Sample Information

Static Analysis

Impersonation

PEStudio revealed the malware sets its FileDescription to Adobe Installer — a social engineering tactic to appear legitimate and reduce suspicion if a victim inspects the file properties.

Decompilation — AES Encryption

Loading the sample in dnSpy exposed the malware’s .NET internals. Browsing the decompiled class structure revealed a RijndaelManaged class — .NET’s implementation of AES encryption — used to encrypt and obfuscate the malware’s configuration data. Digging into the encryption method exposed the hardcoded key string used to derive the AES key and IV:

Hardcoded key: 8xTJ0EKPuiQsJVaT

Anti-Analysis Checks

The sample performs 5 anti-analysis checks to detect sandboxes and debugging environments, including checking for the presence of SbieDll.dll — a DLL associated with the Sandboxie sandbox environment. Detection of this DLL causes the malware to alter or halt its execution.

Critical APIs Identified

Dynamic Analysis — Any.run

Executing the sample in Any.run sandbox revealed the full runtime behaviour including C2 communication, file drops, and persistence mechanisms.

C2 Communication

The malware decrypts its C2 configuration at runtime using the hardcoded AES key and establishes outbound connections:

|C2 IP|Port| |—|—| |185[.]117[.]250[.]169|7000| |66[.]175[.]239[.]149|7000| |185[.]117[.]249[.]43|7000|

Persistence

The malware drops a copy of itself to:

C:\Users\admin\AppData\Roaming\WmiPrvSE.exe

A scheduled task named WmiPrvSE is created to execute the dropped binary with elevated privileges — masquerading as the legitimate Windows Management Instrumentation process to blend in.

USB Spreading

XWorm copies itself to every connected removable device as USB.exe. To ensure autoexecution on the target device it creates .lnk shortcut files — when the victim opens the drive and clicks the shortcut, the malware executes.

Registry Manipulation

The malware modifies the ShowSuperHidden registry key to control hidden file visibility in Windows Explorer — concealing its dropped files and persistence artifacts from casual inspection.

![[xworm_super_hidden.png]]

Attack Chain

Phishing email → victim executes fake Adobe Installer
        ↓
Anti-analysis checks (5) — SbieDll.dll detection, sandbox evasion
        ↓
Drops WmiPrvSE.exe to AppData
        ↓
Creates scheduled task WmiPrvSE for persistence
        ↓
Modifies ShowSuperHidden registry key — hides artifacts
        ↓
Marks process critical via RtlSetProcessIsCritical
        ↓
Installs keyboard hook via SetWindowsHookEx — keylogger active
        ↓
Decrypts C2 config (AES / 8xTJ0EKPuiQsJVaT) → beacons to C2 on port 7000
        ↓
Copies self to removable drives as USB.exe + .lnk autorun

IOCs

MITRE ATT&CK

|Technique|ID| |—|—| |Phishing: Spearphishing Attachment|T1566.001| |Masquerading|T1036| |Scheduled Task/Job|T1053.005| |Boot or Logon Autostart Execution|T1547| |Virtualization/Sandbox Evasion|T1497| |Obfuscated Files or Information: Encrypted/Encoded File|T1027.013| |Input Capture: Keylogging|T1056.001| |Replication Through Removable Media|T1091| |Application Layer Protocol|T1071| |Modify Registry|T1112|

Key Takeaway

XWorm v2 demonstrates a layered approach to persistence and evasion — from scheduled task masquerading as a legitimate Windows process, to marking itself as a critical process to survive termination attempts. The RtlSetProcessIsCritical API is a notable technique worth flagging in detections as it is rarely used by legitimate software and immediately indicates malicious intent. Static analysis via dnSpy on .NET malware consistently yields high-value findings — config decryption keys, C2 infrastructure, and API usage — without requiring full sandbox execution.

References

• Any.run Report
• Threat.rip Config Extract

• VMRay Analysis