Analysis
- max time kernel
149s - max time network
135s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
27/02/2024, 10:16
General
- Target rClsgMar.19–S.scr.exe
- Size 536KB
- Sample240227-massvaeb35
- SHA256 da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d
Malware Config
Extracted
-
xworm
-
104.250.180.178:7061
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
- Detect Xworm Payload 9 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Drops startup file 2 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 33 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\rClsgMar.19–S.scr.exe"C:\Users\Admin\AppData\Local\Temp\rClsgMar.19–S.scr.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rClsgMar.19–S.scr.exe"C:\Users\Admin\AppData\Local\Temp\rClsgMar.19–S.scr.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\rClsgMar.19–S.scr.exe"C:\Users\Admin\AppData\Local\Temp\rClsgMar.19–S.scr.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\rClsgMar.19–S.scr.exe"C:\Users\Admin\AppData\Local\Temp\rClsgMar.19–S.scr.exe"2⤵
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\rClsgMar.19–S.scr.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'rClsgMar.19–S.scr.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
d93f411851d7c929.customDestinations-ms
XClient.exe
memory/1276-40-0x0000000070BF0000-0x000000007119B000-memory.dmp
memory/1276-41-0x00000000025E0000-0x0000000002620000-memory.dmp
memory/1276-46-0x0000000070BF0000-0x000000007119B000-memory.dmp
memory/1276-45-0x00000000025E0000-0x0000000002620000-memory.dmp
memory/1276-44-0x00000000025E0000-0x0000000002620000-memory.dmp
memory/1276-42-0x0000000070BF0000-0x000000007119B000-memory.dmp
memory/1944-32-0x000000006F670000-0x000000006FC1B000-memory.dmp
memory/1944-33-0x000000006F670000-0x000000006FC1B000-memory.dmp
memory/1944-34-0x000000006F670000-0x000000006FC1B000-memory.dmp
memory/2052-52-0x000000006F670000-0x000000006FC1B000-memory.dmp
memory/2052-56-0x000000006F670000-0x000000006FC1B000-memory.dmp
memory/2052-55-0x0000000002730000-0x0000000002770000-memory.dmp
memory/2052-53-0x000000006F670000-0x000000006FC1B000-memory.dmp
memory/2052-54-0x0000000002730000-0x0000000002770000-memory.dmp
memory/2608-10-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2608-43-0x0000000074560000-0x0000000074C4E000-memory.dmp
memory/2608-63-0x0000000004CB0000-0x0000000004CF0000-memory.dmp
memory/2608-62-0x0000000004CB0000-0x0000000004CF0000-memory.dmp
memory/2608-7-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2608-8-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2608-19-0x0000000074560000-0x0000000074C4E000-memory.dmp
memory/2608-18-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2608-9-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2608-15-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2608-13-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2608-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2692-2-0x0000000004D30000-0x0000000004D70000-memory.dmp
memory/2692-17-0x0000000074560000-0x0000000074C4E000-memory.dmp
memory/2692-6-0x0000000005BF0000-0x0000000005C46000-memory.dmp
memory/2692-5-0x00000000006D0000-0x00000000006E2000-memory.dmp
memory/2692-4-0x0000000000660000-0x000000000066C000-memory.dmp
memory/2692-3-0x0000000001F00000-0x0000000001F22000-memory.dmp
memory/2692-0-0x0000000000230000-0x00000000002BC000-memory.dmp
memory/2692-1-0x0000000074560000-0x0000000074C4E000-memory.dmp
memory/2860-22-0x0000000070BF0000-0x000000007119B000-memory.dmp
memory/2860-26-0x0000000070BF0000-0x000000007119B000-memory.dmp
memory/2860-25-0x00000000026F0000-0x0000000002730000-memory.dmp
memory/2860-24-0x00000000026F0000-0x0000000002730000-memory.dmp
memory/2860-23-0x0000000070BF0000-0x000000007119B000-memory.dmp