TrojanDownloader:Win32/XWorm.A!MTB

The TrojanDownloader:Win32/XWorm.A!MTB infection process begins when the malware arrives on a device, often dropped by other malware or app downloads. To ensure it runs every time Windows starts, it employs multiple autostart techniques. It drops a file named EcoScape.url in the Windows User Startup folder, which points to a malicious JavaScript file located in the %AppDataLocal%\EcoVision Dynamics\ folder. Another variant adds a registry entry named "msedge" in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, directing the system to launch a hidden copy of the malware disguised as msedge.exe in the %Application Data% folder.  

During installation, the malware creates numerous files and folders, setting their attributes to SYSTEM and HIDDEN to avoid casual detection. Key components are dropped in the %Temporary Internet Files% and %AppDataLocal%\EcoVision Dynamics folders, with files such as RegAsm.exe, AutoIt3.exe, and EcoScape.js. A keylogger file is created at %User Temp%\Log.tmp or %AppDataLocal%\Temp\Log.tmp to capture keystrokes. The malware further modifies the registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden, changing its value to '0' to prevent Windows from displaying hidden files and protected system files.  

It uses cmd.exe for file manipulation and tasklist alongside findstr to check for the presence of specific antivirus and security processes like avastui.exe, avgui.exe, and wrsa.exe. It also launches PowerShell commands to add exclusions for itself in Microsoft Defender, attempting to deactivate security controls. To ensure only one instance runs, it creates mutexes with names like 0vyG14tDobaS6ejo and oXwnhd5ZIRDDutbH. Xworm then acts as a backdoor, connecting to its Command and Control (C2) servers using TCP to receive instructions and exfiltrate stolen data. It has been observed communicating with infrastructure including the IP address 192[.]3.182.92[:]7006 and the domains kribyrisk[.]com and {BLOCKED}dns.org:1111. 

Files dropped by Xworm: 

• msedge.exe  
• RegAsm.exe 
• AutoIt3.exe 
• EcoScape.js 
• %AppDataLocal%\Temp\Log.tmp  
• %User Temp%\Log.tmp  

It modifies the following Windows processes: 

• avastui.exe 
• avgui.exe 
• wrsa.exe  

It modifies the following registry key: 

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden, changing its value to '0' 

Communicates to the following hosts: 

• 192[.]3.182.92[:]7006  

Access or downloads from the following URLs: 

• {BLOCKED}dns.org:1111 
• kribyrisk[.]com