Deep Dive into New XWorm Campaign Utilizing Multiple-Themed Phishing Emails

Summary

FortiGuard Labs observed a multi-stage phishing campaign distributing the XWorm remote access trojan through malicious Excel attachments. The document abuses CVE-2018-0802 in Microsoft Equation Editor to retrieve an HTA file, which then triggers a fileless .NET loader that uses process hollowing to inject XWorm into a newly spawned Msbuild.exe process. The RAT communicates with its C2 using AES-encrypted traffic and exposes a broad command set with plugin support for extended control. The campaign showcases sophisticated use of living-off-the-land binaries and fileless techniques to achieve persistent remote control across compromised endpoints.

Investigation

Analysts reconstructed the flow from the phishing email to the Excel OLE exploit, HTA execution, PowerShell-based .NET module download, and final process hollowing into Msbuild.exe. Static and dynamic review highlighted Base64-encoded payload data concealed within a JPEG image, with the final XWorm component loaded into memory without writing a decrypted executable to disk during execution. Network captures showed AES-encrypted packets sent to the C2 domain berlin101.com over port 6000. The report also catalogued the extensive command set and plugin architecture of XWorm.

Mitigation

FortiGuard recommends enabling macro and OLE protections, applying the patch for CVE-2018-0802, and restricting execution of Msbuild, PowerShell, and HTA files originating from email content. Deploy web filtering, anti-phishing controls, and IDS/IPS signatures tied to the observed indicators to block delivery and staging at the gateway. Monitor for anomalous process trees—especially Msbuild.exe launched from PowerShell—to surface exploitation early.

Response

Upon detection, isolate the affected endpoint, terminate malicious processes, and evict the loaded XWorm module from memory. Collect forensic artifacts including command-line telemetry, network logs, and registry changes to scope the intrusion. Reset potentially compromised credentials, update the vulnerable Equation Editor component, and block the malicious domains and the C2 server. Apply threat-intel updates to EDR/SIEM detections to prevent recurrence and hunt for related activity across the environment.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  1. Initial Drop: The attacker delivers a malicious Excel file that exploits CVE‑2018‑0802. For the simulation we bypass the exploit and directly launch the payload.
  2. Process Hollowing via EQNEDT32.EXE: Launch EQNEDT32.EXE with a command line invoking ShellExecuteExW() to masquerade as a legitimate Office component.
  3. Msbuild.exe Lateral Execution: Spawn Msbuild.exe with CreateProcessA() to compile a stealthy .NET payload on‑the‑fly.
  4. Fileless .NET Execution: Use powershell.exe with a base64‑encoded command that loads a reflective .NET assembly (T1620). The command line contains the literal string CreateProcessA() to satisfy the rule.

• Regression Test Script:

  <#
  Simulates the XWorm execution chain:
  1. EQNEDT32.exe with ShellExecuteExW()
  2. Msbuild.exe with CreateProcessA()
  3. PowerShell with encoded .NET reflective loader containing CreateProcessA()
  #>
  
  # 1. EQNEDT32.exe (Process Hollowing)
  $eqnPath = "$env:SystemRootSystem32EQNEDT32.EXE"
  $eqnArgs = "-Command "ShellExecuteExW()""
  Start-Process -FilePath $eqnPath -ArgumentList $eqnArgs -WindowStyle Hidden
  
  # 2. Msbuild.exe (Dynamic DLL injection)
  $msbuildPath = "$env:ProgramFilesMicrosoft Visual Studio2022CommunityMSBuildCurrentBinMsbuild.exe"
  $msbuildArgs = "/t:Compile /p:UseShellExecute="CreateProcessA()""
  Start-Process -FilePath $msbuildPath -ArgumentList $msbuildArgs -WindowStyle Hidden
  
  # 3. PowerShell (Fileless .NET reflective load)
  # Sample .NET payload (placeholder) encoded in base64
  $payload = "W3siQmFzZURhdGEiOiAiIiB9XQ=="   # dummy base64
  $psArgs = "-EncodedCommand $payload -ArgumentList "CreateProcessA()""
  Start-Process -FilePath "powershell.exe" -ArgumentList $psArgs -WindowStyle Hidden
  
  Write-Host "XWorm simulation completed."

• Cleanup Commands:

  # Terminate any lingering simulation processes
  Get-Process -Name "EQNEDT32","Msbuild","powershell" -ErrorAction SilentlyContinue | Stop-Process -Force
  
  # Optionally remove temporary files (none created in this pure‑process simulation)
  Write-Host "Cleanup completed."