Analysis
- max time kernel
147s - max time network
148s - platform
windows7_x64 - resource
win7-20240215-en - resource tags
- submitted
28/03/2024, 04:46
General
- Target good.exe
- Size 71KB
- Sample240328-fd86nsec91
- SHA256 b8bb137f8b74d60d472c7747b5bb73c4deafcc985481fec1de307794c3370796
Malware Config
Extracted
-
xworm
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Detects Windows executables referencing non-Windows User-Agents 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\good.exe"C:\Users\Admin\AppData\Local\Temp\good.exe"1⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\good.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'good.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
590aee7bdd69b59b.customDestinations-ms
memory/2012-53-0x0000000002980000-0x0000000002A00000-memory.dmp
memory/2012-49-0x0000000002980000-0x0000000002A00000-memory.dmp
memory/2012-54-0x000007FEED390000-0x000007FEEDD2D000-memory.dmp
memory/2012-48-0x000007FEED390000-0x000007FEEDD2D000-memory.dmp
memory/2012-52-0x0000000002980000-0x0000000002A00000-memory.dmp
memory/2012-51-0x0000000002980000-0x0000000002A00000-memory.dmp
memory/2012-50-0x000007FEED390000-0x000007FEEDD2D000-memory.dmp
memory/2272-47-0x000000001B160000-0x000000001B1E0000-memory.dmp
memory/2272-2-0x000000001B160000-0x000000001B1E0000-memory.dmp
memory/2272-0-0x00000000009F0000-0x0000000000A08000-memory.dmp
memory/2272-29-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp
memory/2272-1-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp
memory/2440-41-0x000007FEEDD30000-0x000007FEEE6CD000-memory.dmp
memory/2440-40-0x0000000002890000-0x0000000002910000-memory.dmp
memory/2440-38-0x000007FEEDD30000-0x000007FEEE6CD000-memory.dmp
memory/2440-39-0x0000000002890000-0x0000000002910000-memory.dmp
memory/2440-37-0x0000000002890000-0x0000000002910000-memory.dmp
memory/2440-36-0x000007FEEDD30000-0x000007FEEE6CD000-memory.dmp
memory/2536-13-0x0000000002CF0000-0x0000000002D70000-memory.dmp
memory/2536-15-0x000007FEEDD30000-0x000007FEEE6CD000-memory.dmp
memory/2536-7-0x000000001B5F0000-0x000000001B8D2000-memory.dmp
memory/2536-9-0x000007FEEDD30000-0x000007FEEE6CD000-memory.dmp
memory/2536-10-0x0000000002CF0000-0x0000000002D70000-memory.dmp
memory/2536-8-0x0000000002810000-0x0000000002818000-memory.dmp
memory/2536-11-0x000007FEEDD30000-0x000007FEEE6CD000-memory.dmp
memory/2536-12-0x0000000002CF0000-0x0000000002D70000-memory.dmp
memory/2536-14-0x0000000002CF0000-0x0000000002D70000-memory.dmp
memory/2620-26-0x0000000002980000-0x0000000002A00000-memory.dmp
memory/2620-21-0x000000001B600000-0x000000001B8E2000-memory.dmp
memory/2620-23-0x0000000002730000-0x0000000002738000-memory.dmp
memory/2620-22-0x000007FEED390000-0x000007FEEDD2D000-memory.dmp
memory/2620-24-0x0000000002980000-0x0000000002A00000-memory.dmp
memory/2620-28-0x0000000002980000-0x0000000002A00000-memory.dmp
memory/2620-25-0x0000000002980000-0x0000000002A00000-memory.dmp
memory/2620-30-0x000007FEED390000-0x000007FEEDD2D000-memory.dmp
memory/2620-27-0x000007FEED390000-0x000007FEEDD2D000-memory.dmp