Analysis
- max time kernel
146s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
27/02/2024, 10:16
General
- Target rClsgMar.19–S.scr.exe
- Size 536KB
- Sample240227-massvaeb35
- SHA256 da2b56af1ae9569c8848e2a422d48b67c3958f2f9429ff04ef27e0c1bf82ca1d
Malware Config
Extracted
-
xworm
-
104.250.180.178:7061
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\rClsgMar.19–S.scr.exe"C:\Users\Admin\AppData\Local\Temp\rClsgMar.19–S.scr.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rClsgMar.19–S.scr.exe"C:\Users\Admin\AppData\Local\Temp\rClsgMar.19–S.scr.exe"2⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\rClsgMar.19–S.scr.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'rClsgMar.19–S.scr.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
rClsgMar.19–S.scr.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_x4sv0sau.c4n.ps1
memory/1128-140-0x00000000749F0000-0x00000000751A0000-memory.dmp
memory/1128-129-0x0000000070010000-0x000000007005C000-memory.dmp
memory/1128-115-0x00000000749F0000-0x00000000751A0000-memory.dmp
memory/1128-128-0x000000007F2B0000-0x000000007F2C0000-memory.dmp
memory/1128-116-0x0000000002B10000-0x0000000002B20000-memory.dmp
memory/1128-117-0x0000000002B10000-0x0000000002B20000-memory.dmp
memory/1144-14-0x00000000749F0000-0x00000000751A0000-memory.dmp
memory/1144-74-0x00000000749F0000-0x00000000751A0000-memory.dmp
memory/1144-146-0x00000000055D0000-0x00000000055E0000-memory.dmp
memory/1144-11-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1144-145-0x00000000055D0000-0x00000000055E0000-memory.dmp
memory/1552-3-0x0000000004BE0000-0x0000000004C72000-memory.dmp
memory/1552-2-0x0000000005190000-0x0000000005734000-memory.dmp
memory/1552-10-0x000000000BE00000-0x000000000BE56000-memory.dmp
memory/1552-9-0x0000000005180000-0x0000000005192000-memory.dmp
memory/1552-8-0x0000000005160000-0x000000000516C000-memory.dmp
memory/1552-7-0x0000000004FF0000-0x0000000005012000-memory.dmp
memory/1552-6-0x0000000004E50000-0x0000000004EEC000-memory.dmp
memory/1552-5-0x0000000004C80000-0x0000000004C8A000-memory.dmp
memory/1552-4-0x0000000004D50000-0x0000000004D60000-memory.dmp
memory/1552-15-0x00000000749F0000-0x00000000751A0000-memory.dmp
memory/1552-0-0x00000000749F0000-0x00000000751A0000-memory.dmp
memory/1552-1-0x0000000000180000-0x000000000020C000-memory.dmp
memory/2188-102-0x0000000004FC0000-0x0000000004FD0000-memory.dmp
memory/2188-103-0x0000000070010000-0x000000007005C000-memory.dmp
memory/2188-90-0x0000000004FC0000-0x0000000004FD0000-memory.dmp
memory/2188-91-0x0000000004FC0000-0x0000000004FD0000-memory.dmp
memory/2188-114-0x00000000749F0000-0x00000000751A0000-memory.dmp
memory/2188-89-0x00000000749F0000-0x00000000751A0000-memory.dmp
memory/2992-49-0x0000000006C40000-0x0000000006CE3000-memory.dmp
memory/2992-28-0x0000000005450000-0x00000000054B6000-memory.dmp
memory/2992-53-0x0000000006FF0000-0x0000000007086000-memory.dmp
memory/2992-54-0x0000000006F70000-0x0000000006F81000-memory.dmp
memory/2992-55-0x0000000006FC0000-0x0000000006FCE000-memory.dmp
memory/2992-56-0x0000000006FD0000-0x0000000006FE4000-memory.dmp
memory/2992-57-0x00000000070D0000-0x00000000070EA000-memory.dmp
memory/2992-58-0x00000000070B0000-0x00000000070B8000-memory.dmp
memory/2992-60-0x00000000749F0000-0x00000000751A0000-memory.dmp
memory/2992-16-0x0000000000CC0000-0x0000000000CF6000-memory.dmp
memory/2992-17-0x00000000749F0000-0x00000000751A0000-memory.dmp
memory/2992-18-0x0000000000D30000-0x0000000000D40000-memory.dmp
memory/2992-19-0x0000000000D30000-0x0000000000D40000-memory.dmp
memory/2992-51-0x0000000006D70000-0x0000000006D8A000-memory.dmp
memory/2992-20-0x0000000004D40000-0x0000000005368000-memory.dmp
memory/2992-21-0x0000000004C80000-0x0000000004CA2000-memory.dmp
memory/2992-27-0x0000000005370000-0x00000000053D6000-memory.dmp
memory/2992-50-0x00000000073B0000-0x0000000007A2A000-memory.dmp
memory/2992-48-0x0000000006010000-0x000000000602E000-memory.dmp
memory/2992-38-0x0000000070010000-0x000000007005C000-memory.dmp
memory/2992-37-0x0000000006030000-0x0000000006062000-memory.dmp
memory/2992-36-0x0000000000D30000-0x0000000000D40000-memory.dmp
memory/2992-35-0x0000000005B10000-0x0000000005B5C000-memory.dmp
memory/2992-34-0x0000000005A80000-0x0000000005A9E000-memory.dmp
memory/2992-33-0x0000000005660000-0x00000000059B4000-memory.dmp
memory/2992-52-0x0000000006DE0000-0x0000000006DEA000-memory.dmp
memory/4880-88-0x00000000749F0000-0x00000000751A0000-memory.dmp
memory/4880-76-0x000000007F1F0000-0x000000007F200000-memory.dmp
memory/4880-77-0x0000000070010000-0x000000007005C000-memory.dmp
memory/4880-75-0x0000000004AA0000-0x0000000004AB0000-memory.dmp
memory/4880-63-0x0000000004AA0000-0x0000000004AB0000-memory.dmp
memory/4880-62-0x0000000004AA0000-0x0000000004AB0000-memory.dmp
memory/4880-61-0x00000000749F0000-0x00000000751A0000-memory.dmp