TrojanSpy.Win32.XWORM.A

 Analysis by: Neljorn Nathaniel Aguas

 ALIASES:

UDS:Backdoor.Win32.Agent.myuvwd (KASPERSKY)

 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Trojan Spy

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

Infection Channel:

Dropped by other malware, Downloaded from the Internet


This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

It logs a user's keystrokes to steal information.

  TECHNICAL DETAILS

File Size:

10,515,536 bytes

File Type:

EXE

File Compression:

NSIS

Memory Resident:

Yes

Initial Samples Received Date:

29 Mar 2024

Payload:

Connects to URLs/IPs, Logs keystrokes, Collects system information, Hides files and processes, Steals information

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy drops the following files:

  • %Temporary Internet Files%\{Random Numbers}\RegAsm.exe
  • %AppDataLocal%\EcoVision Dynamics\EcoScape.js
  • If avastui.exe | avgui.exe | nswscsvc.exe | sophoshealth.exe is found running on the system:
    • %Temporary Internet Files%\{Random Numbers}\AutoIt3.exe
    • %Temporary Internet Files%\{Random Numbers}\R.au3
    • %AppDataLocal%\EcoVision Dynamics\A.a3x
    • %AppDataLocal%\EcoVision Dynamics\AutoIt3.exe
    Otherwise:
    • %Temporary Internet Files%\{Random Numbers}\Telecom.pif
    • %Temporary Internet Files%\{Random Numbers}\R
    • %AppDataLocal%\EcoVision Dynamics\A
    • %AppDataLocal%\EcoVision Dynamics\EcoScape.pif
  • Sets the attributes to SYSTEM and HIDDEN:
    • %Temporary Internet Files%\Commander
    • %Temporary Internet Files%\Papers
    • %Temporary Internet Files%\Keyboard
    • %Temporary Internet Files%\Plugins
    • %Temporary Internet Files%\Cameras
    • %Temporary Internet Files%\Cutting.bat
    • %Temporary Internet Files%\Friends
    • %Temporary Internet Files%\Northeast
    • %Temporary Internet Files%\Fears
    • %Temporary Internet Files%\Tramadol
    • %Temporary Internet Files%\Stream

(Note: %Temporary Internet Files% is the Temporary Internet Files folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temporary Internet Files on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Microsoft\Windows\Temporary Internet Files on Windows Vista, 7 and 2008(64-bit), or C:\Users\{user name}\AppData\Local\Microsoft\Windows\INetCache on Windows 8, 8.1, 2012(64-bit) and 10(64-bit).. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

  • "%System%\cmd.exe" /c move Cutting Cutting.bat & Cutting.bat
  • tasklist
  • findstr /I "wrsa.exe opssvc.exe"
  • findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
  • cmd /c md {Random Numbers}
  • If avastui.exe | avgui.exe | nswscsvc.exe | sophoshealth.exe is found running on the system:
    • cmd /c copy /b Northeast + Cameras + Papers + Friends + Fears + Commander + Tramadol + Plugins {Random Numbers}\AutoIt3.exe
    • cmd /c copy /b Stream + Keyboard {Random Numbers}\R.au3
    • {Random Numbers}\AutoIt3.exe {Random Numbers}\R.au3
    Otherwise:
    • cmd /c copy /b Northeast + Cameras + Papers + Friends + Fears + Commander + Tramadol + Plugins {Random Numbers}\Telecom.pif
    • cmd /c copy /b Stream + Keyboard {Random Numbers}\R
    • {Random Numbers}\Telecom.pif {Random Numbers}\R
  • If wrsa.exe | opssvc.exe is found running on the system:
    • ping -n 199 127.0.0.1
    Otherwise:
    • ping -n 5 127.0.0.1
  • schtasks.exe /create /tn "Impaired" /tr "wscript //B '%AppDataLocal%\EcoVision Dynamics\EcoScape.js'" /sc minute /mo 3 /F

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It creates the following folders:

  • %AppDataLocal%\EcoVision Dynamics
  • %Temporary Internet Files%\{Random Numbers}

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Temporary Internet Files% is the Temporary Internet Files folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temporary Internet Files on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Microsoft\Windows\Temporary Internet Files on Windows Vista, 7 and 2008(64-bit), or C:\Users\{user name}\AppData\Local\Microsoft\Windows\INetCache on Windows 8, 8.1, 2012(64-bit) and 10(64-bit).)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

  • 0vyG14tDobaS6ejo

Autostart Technique

This Trojan Spy drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:

  • %User Startup%\EcoScape.url
    • Which contains the following target URL:
      • file:///%AppDataLocal%/EcoVision%20Dynamics/EcoScape.js

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Backdoor Routine

This Trojan Spy executes the following commands from a remote malicious user:

  • pongSends a "pong" string to the C2
  • recRestarts the application
  • CLOSECloses the application
  • uninstallExecutes the uninstall commands
  • updateExecutes the uninstall commands and the updated binary
  • DWExecutes a powershell script
  • FMExecutes a command from the C2 in memory
  • LNDownloads a file from a URL and execute it
  • UrlopenOpens a URL through a browser
  • UrlhideCreates a HTTP GET request
  • PCShutdownExecutes a shutdown command
  • PCRestartExecutes a restart command
  • PCLogoffExecutes a logoff command
  • RunShellExecutes a command
  • StartDDosInitiates DDoS activities
  • StopDDosTerminates DDoS activities
  • StartReportSends a list of running processes
  • StopReportTerminates sending of running proccesses list
  • XchatSends a "Xchat" string and the ID generated using system information
  • HostsSends the drivers\etc\host file contents
  • ShostsModifies the contents of a file
  • DDosSends a "DDos" string to the C2
  • pluginDecompresses and executes a plugin
  • savePluginSaves the decoded plugin to a registry then decompresses and executes it
  • RemovePluginsDeletes the registry with plugin data
  • OfflineGetSends the contents of the keylogger file
  • $capSends a screen capture

It connects to the following URL(s) to send and receive commands from a remote malicious user:

  • {BLOCKED}.{BLOCKED}.{BLOCKED}.142:8989

Dropping Routine

This Trojan Spy drops the following file(s), which it uses for its keylogging routine:

  • %AppDataLocal%\Temp\Log.tmp

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Information Theft

This Trojan Spy gathers the following data:

  • MD5 Hash of the following concatenated data:
    • Processor count
    • Username
    • Machine name
    • OS version
    • Total size of system drive
  • Username
  • OS Full Name, Version, and Architecture
  • Malware's original filename → "ASGARD"
  • Malware's last modification date
  • True | False → if executed using the filename "USB.exe"
  • True | False → if executed with admin rights
  • True | False → if camera is present
  • CPU Information
  • GPU Information
  • RAM Information
  • Installed Antivirus Information
  • Active Window Title

It logs a user's keystrokes to steal information.

Stolen Information

This Trojan Spy sends the gathered information via HTTP POST to the following URL:

  • {BLOCKED}.{BLOCKED}.{BLOCKED}.142:8989

Other Details

This Trojan Spy checks for the presence of the following process(es):

  • wrsa.exe
  • opssvc.exe
  • avastui.exe
  • avgui.exe
  • nswscsvc.exe
  • sophoshealth.exe

It does the following:

  • It connects to the following URL that contains a text of the C&C server address:
    • https://{BLOCKED}in.com/raw/Dh8E7H3R

It adds the following scheduled tasks:

  • Location: {Scheduled Task Root Directory}
    Task Name: Impaired
    Trigger: One Time (from creation date, triggers every 3 minutes indefinitely)
    Action: Start a program - wscript //B "%AppDataLocal%\EcoVision Dynamics\EcoScape.js"

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

  SOLUTION

Minimum Scan Engine:

9.800

FIRST VSAPI PATTERN FILE:

19.258.05

FIRST VSAPI PATTERN DATE:

04 Apr 2024

VSAPI OPR PATTERN File:

19.259.00

VSAPI OPR PATTERN Date:

05 Apr 2024

Step 1

Before doing any scans, Windows 7, Windows 8, Windows 8.1, and Windows 10 users must disable System Restore to allow full scanning of their computers.

Step 2

Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

Step 3

Restart in Safe Mode

[ Learn More ]

Step 4

Deleting Scheduled Tasks while in Safe Mode

  1. Still in safe mode, the following {Task Name}-{Task to be run} listed should be used in the steps identified below:
    • Task Name: Impaired
    • Task to be run: wscript //B "%AppDataLocal%\EcoVision Dynamics\EcoScape.js"
  2. For Windows 7 and Server 2008 (R2) users, click Start>Computer.
    • For Windows 8, 8.1, 10, and Server 2012 users, right-click on the lower left corner of the screen, then click File Explorer.
  3. In the Search Computer/This PC input box, type:
    • %System%\Tasks\{Task Name}
  4. Once located, select the file then press SHIFT+DELETE to delete it.
  5. Open Registry Editor. To do this:
    • For Windows 7 and Server 2008 (R2) users, click the Start button, type regedit in the Search input field, and press Enter.
    • For Windows 8, 8.1, 10, and Server 2012 (R2) users, right-click on the lower left corner of the screen, click Run, type regedit in the text box
  6. In the left panel of the Registry Editor window, double-click the following:
    • HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Schedule>TaskCache>Tree>{Task Name}
  7. Locate the created entry and take note of the registry value's data:
    • ID={Task Data}
  8. After taking note of the data, delete the registry key:
    • HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Schedule>TaskCache>Tree>{Task Name}
  9. In the left panel of the Registry Editor window, double-click the following:
    • HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Schedule>TaskCache>Tasks
  10. Still in the left panel, locate and delete the registry key with the same name as the located Task Data in step #6:
    • ={Task Data}
  11. Close Registry Editor.

Step 5

  1. Open a command prompt.
    • For Windows 7 users, click Start, enter CMD in the Find input field, and press Enter.
  2. In the CMD console, enter the following:

    ATTRIB [+R | -R] [+A | -A ] [+S | -S] [+H | -H] [+I | -I] [drive:][path][filename] [/S [/D] [/L]]

    Where:
    + Activates an attribute
    - Disables an attribute
    R Read-only file attribute
    A Archive file attribute
    S System file attribute
    H Hidden file attribute
    I Indexed file attribute without content
    [drive:][path][filename]
    Specifies one or more files in the current folder and all its subfolders
    /S Processes the corresponding files in the current folder and all its subfolders
    /D Process folders
    /L Act on the attributes of the symbolic link instrad of the target of the symbolic link
    Example:
    To make all files and folders (including subfolders visible in drive D:
    ATTRIB –H D:\* /S /D
  3. Repeat the step above for folders and files from other drives or directories.

Step 6

Search and delete these files

[ Learn More ]
There may be some files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.
  • %User Startup%\EcoScape.url
  • %AppDataLocal%\Temp\Log.tmp
  • %AppDataLocal%\EcoVision Dynamics\EcoScape.js
  • %Temporary Internet Files%\{Random Numbers}\RegAsm.exe
  • %Temporary Internet Files%\Commander
  • %Temporary Internet Files%\Papers
  • %Temporary Internet Files%\Keyboard
  • %Temporary Internet Files%\Plugins
  • %Temporary Internet Files%\Cameras
  • %Temporary Internet Files%\Cutting.bat
  • %Temporary Internet Files%\Friends
  • %Temporary Internet Files%\Northeast
  • %Temporary Internet Files%\Fears
  • %Temporary Internet Files%\Tramadol
  • %Temporary Internet Files%\Stream
  • %Temporary Internet Files%\{Random Numbers}\AutoIt3.exe or %Temporary Internet Files%\{Random Numbers}\Telecom.pif
  • %Temporary Internet Files%\{Random Numbers}\R.au3 or %Temporary Internet Files%\{Random Numbers}\R
  • %AppDataLocal%\EcoVision Dynamics\A.a3x or %AppDataLocal%\EcoVision Dynamics\A
  • %AppDataLocal%\EcoVision Dynamics\AutoIt3.exe or %AppDataLocal%\EcoVision Dynamics\EcoScape.pif

Step 7

Search and delete these folders

[ Learn More ]
Please make sure you check the Search Hidden Files and Folders checkbox in the More advanced options option to include all hidden folders in the search result.
  • %AppDataLocal%\EcoVision Dynamics
  • %Temporary Internet Files%\{Random Numbers}

Step 8

Restart in normal mode and scan your computer with your Trend Micro product for files detected as TrojanSpy.Win32.XWORM.A. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.


Did this description help? Tell us how we did.