Analysis

  • max time kernel
    200s
  • max time network
    208s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/03/2024, 23:07

Errors

Reason
Machine shutdown

General

  • Target

    XClient.exe

  • Size

    68KB

  • MD5

    dea0e75dc3142c29ace4526228f8e47c

  • SHA1

    304b5fe2863e63c231bd7d0d833334a030cf65e2

  • SHA256

    dd68bd8d2da4ba41c11af01920eb6a89a5b7d96bfcf326ca0be04e886eebcaef

  • SHA512

    28001cf9650bf0df86033c84d85d890f37c351819da949debba9bef1433c81d99f39a091eb378548939514cdf5decdb042bd0a3fe427d5a80f2689c80b274787

  • SSDEEP

    1536:URkFtXMDh+0BT51gYgd3Gu+bXnVtBMN28qhH1KOgnHGBQi1:UmUM0fundWu+bXnntVKOAGqi1

Malware Config

Extracted

Family

xworm

C2

86.173.127.81:7000

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Drops startup file 2 IoCs
  • Drops desktop.ini file(s) 17 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
    1⤵
    • Drops startup file
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1676
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4172
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfd7c46f8,0x7ffcfd7c4708,0x7ffcfd7c4718
        3⤵
          PID:2996
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,17742771224129272755,1163879962782628284,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
          3⤵
            PID:4684
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,17742771224129272755,1163879962782628284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:572
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,17742771224129272755,1163879962782628284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
            3⤵
              PID:2780
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17742771224129272755,1163879962782628284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3108 /prefetch:1
              3⤵
                PID:2160
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17742771224129272755,1163879962782628284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
                3⤵
                  PID:3468
              • C:\Windows\SYSTEM32\shutdown.exe
                shutdown.exe /f /r /t 0
                2⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2368
            • C:\Windows\System32\CompPkgSrv.exe
              C:\Windows\System32\CompPkgSrv.exe -Embedding
              1⤵
                PID:3300
              • C:\Windows\System32\CompPkgSrv.exe
                C:\Windows\System32\CompPkgSrv.exe -Embedding
                1⤵
                  PID:3540
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k UnistackSvcGroup
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4540
                • C:\Windows\system32\LogonUI.exe
                  "LogonUI.exe" /flags:0x4 /state0:0xa3999055 /state1:0x41c64e6d
                  1⤵
                  • Modifies data under HKEY_USERS
                  • Suspicious use of SetWindowsHookEx
                  PID:456

                Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

                        Filesize

                        16KB

                        MD5

                        dadb22ad1dea7317694522751468b22c

                        SHA1

                        227020cb4b33f889c992bdb90b10f90d597bc3ee

                        SHA256

                        83da9c397baff71069d7921de0d28afe423e1391e51adb1c6854347ba6835ca1

                        SHA512

                        994ecbfc8ade5001642ffc3cc6c48bdf779c8d51f3f116b7605d5f3ef097e426ce9991ca9cc960e68ea99de59a9379273a85c62bc3d0aaaebf44e374c218dd72

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                        Filesize

                        152B

                        MD5

                        0764f5481d3c05f5d391a36463484b49

                        SHA1

                        2c96194f04e768ac9d7134bc242808e4d8aeb149

                        SHA256

                        cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3

                        SHA512

                        a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                        Filesize

                        152B

                        MD5

                        e494d16e4b331d7fc483b3ae3b2e0973

                        SHA1

                        d13ca61b6404902b716f7b02f0070dec7f36edbf

                        SHA256

                        a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165

                        SHA512

                        016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        741e8deadcab6f80e636243841e22f9e

                        SHA1

                        692464f949fc52cae7bd2941bdccba21effee008

                        SHA256

                        4473d271c7dd54b3a2c68ecae01d9464754d51a6846d925ff0e2cb671cb244bb

                        SHA512

                        8fe0015660283943993d428cb7c92ee261c5c8055f5055b763ccaca763885b05b2a54a2ca241271211c3d0748ab3a8bc21e77a9454a230e95370a7a6694938e6

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        1892cb725cffdc2bee06b7e891155d89

                        SHA1

                        4af5b5e6cbed03b015803d173b269c76b1b296ca

                        SHA256

                        3917ae9a844189867cf25fd7694cde2c3627bbc23a2e03738fdf5d6c1b7c1fea

                        SHA512

                        8553f63221c6dadaa84a529a72861fdf71dc1e46e55869c4b57ce1e7947933c5b729c34f83c4cc17cf97308f6d545d5c2471c23ba39579c00236080b22691e09

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                        Filesize

                        11KB

                        MD5

                        c55cf53a22a24e9c7405df631fe2fa00

                        SHA1

                        72fa78f8ccf752a90de4cb628649f370ef8f9916

                        SHA256

                        ba077969296a0f5c10c653960d5d10d7296e9f3e810f00b536f0179cb5b1f415

                        SHA512

                        98fb84b46efcb7f8b0f6065723122bda3638e1f62cbf8bd2e2acc1ffa94cde6f732e0f04059ffe113b4392a0dbc6fce98581c33db1fa07e8084f8a9ba64ba34b

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                        Filesize

                        11KB

                        MD5

                        851c4a12f7ce8d227a91f091b939ba25

                        SHA1

                        2684cef64ee080c2555ff2167e6ac1e2e3ba3678

                        SHA256

                        ed56702861dcc10a91bc6bb40a23e0d9020f5d987733cf625c77fb8b2a59db02

                        SHA512

                        f55dd36666db16eaea7d69fd9ceabf78435903c1dc40f2dbf46c9cd7cc00659cf7526eeff4593ec6590a6976d97ea5e9a031d0a6300309c62f59c0cfdd09c7aa

                      • C:\Users\Admin\Desktop\How To Decrypt My Files.html

                        Filesize

                        672B

                        MD5

                        aa9ae29759db840e03aeb6bc5f8a8ab4

                        SHA1

                        0992c647006c1ee6698ff1b56083858d5e69f9ba

                        SHA256

                        9663818672eb277bbdb605926338db8560b174020f1bd38374c5aa7e857b43aa

                        SHA512

                        4532d996c2aaab518e84e8c3d784b830183a595419a739593b7fb68e2c84092dbf356d3d062137b494b3543d8132293a101ed06f8cea24977494511010d5ba40

                      • C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms.ENC

                        Filesize

                        16B

                        MD5

                        ea4118fd2d78736c35363890f44e07cf

                        SHA1

                        90da966a6c60e5dc2b661d5fc3c66db73a51e352

                        SHA256

                        489acd011c5f277a48ff62588b59479a10d6a6cd37472583bd3c6eb0d97a3dac

                        SHA512

                        25b2adec7b3b116c27f148f29f2e861a65ffcdf93dac189a314b9740edfcd2af7d421fbc2795b07db133b2a6971c865f9646c424481f40d6d9d82900a8e5bc33

                      • memory/1676-6-0x000000001B5E0000-0x000000001B5F0000-memory.dmp

                        Filesize

                        64KB

                      • memory/1676-7-0x00007FFCE62C0000-0x00007FFCE6D81000-memory.dmp

                        Filesize

                        10.8MB

                      • memory/1676-0-0x0000000000620000-0x0000000000638000-memory.dmp

                        Filesize

                        96KB

                      • memory/1676-8-0x000000001B5E0000-0x000000001B5F0000-memory.dmp

                        Filesize

                        64KB

                      • memory/1676-11-0x0000000002940000-0x000000000294C000-memory.dmp

                        Filesize

                        48KB

                      • memory/1676-825-0x00007FFCE62C0000-0x00007FFCE6D81000-memory.dmp

                        Filesize

                        10.8MB

                      • memory/1676-1-0x00007FFCE62C0000-0x00007FFCE6D81000-memory.dmp

                        Filesize

                        10.8MB

                      • memory/1676-10-0x0000000000F10000-0x0000000000F1C000-memory.dmp

                        Filesize

                        48KB

                      • memory/4540-258-0x000001A842510000-0x000001A842511000-memory.dmp

                        Filesize

                        4KB

                      • memory/4540-267-0x000001A842120000-0x000001A842121000-memory.dmp

                        Filesize

                        4KB

                      • memory/4540-256-0x000001A842510000-0x000001A842511000-memory.dmp

                        Filesize

                        4KB

                      • memory/4540-259-0x000001A842510000-0x000001A842511000-memory.dmp

                        Filesize

                        4KB

                      • memory/4540-260-0x000001A842510000-0x000001A842511000-memory.dmp

                        Filesize

                        4KB

                      • memory/4540-261-0x000001A842510000-0x000001A842511000-memory.dmp

                        Filesize

                        4KB

                      • memory/4540-262-0x000001A842510000-0x000001A842511000-memory.dmp

                        Filesize

                        4KB

                      • memory/4540-263-0x000001A842510000-0x000001A842511000-memory.dmp

                        Filesize

                        4KB

                      • memory/4540-264-0x000001A842510000-0x000001A842511000-memory.dmp

                        Filesize

                        4KB

                      • memory/4540-265-0x000001A842510000-0x000001A842511000-memory.dmp

                        Filesize

                        4KB

                      • memory/4540-266-0x000001A842130000-0x000001A842131000-memory.dmp

                        Filesize

                        4KB

                      • memory/4540-257-0x000001A842510000-0x000001A842511000-memory.dmp

                        Filesize

                        4KB

                      • memory/4540-269-0x000001A842130000-0x000001A842131000-memory.dmp

                        Filesize

                        4KB

                      • memory/4540-272-0x000001A842120000-0x000001A842121000-memory.dmp

                        Filesize

                        4KB

                      • memory/4540-255-0x000001A8424E0000-0x000001A8424E1000-memory.dmp

                        Filesize

                        4KB

                      • memory/4540-284-0x000001A842060000-0x000001A842061000-memory.dmp

                        Filesize

                        4KB

                      • memory/4540-239-0x000001A839F40000-0x000001A839F50000-memory.dmp

                        Filesize

                        64KB

                      • memory/4540-305-0x000001A842260000-0x000001A842261000-memory.dmp

                        Filesize

                        4KB

                      • memory/4540-307-0x000001A842270000-0x000001A842271000-memory.dmp

                        Filesize

                        4KB

                      • memory/4540-308-0x000001A842270000-0x000001A842271000-memory.dmp

                        Filesize

                        4KB

                      • memory/4540-309-0x000001A842380000-0x000001A842381000-memory.dmp

                        Filesize

                        4KB

                      • memory/4540-223-0x000001A839E40000-0x000001A839E50000-memory.dmp

                        Filesize

                        64KB