Analysis
- max time kernel
146s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
28/03/2024, 04:46
General
- Target good.exe
- Size 71KB
- Sample240328-fd86nsec91
- SHA256 b8bb137f8b74d60d472c7747b5bb73c4deafcc985481fec1de307794c3370796
Malware Config
Extracted
-
xworm
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Detects Windows executables referencing non-Windows User-Agents 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\good.exe"C:\Users\Admin\AppData\Local\Temp\good.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\good.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'good.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ars4hsrn.3v5.ps1
memory/372-1-0x00007FFB24820000-0x00007FFB252E1000-memory.dmp
memory/372-2-0x0000000002270000-0x0000000002280000-memory.dmp
memory/372-53-0x0000000002270000-0x0000000002280000-memory.dmp
memory/372-38-0x00007FFB24820000-0x00007FFB252E1000-memory.dmp
memory/372-0-0x00000000001D0000-0x00000000001E8000-memory.dmp
memory/1628-16-0x00000259EDE40000-0x00000259EDE50000-memory.dmp
memory/1628-15-0x00000259EDE40000-0x00000259EDE50000-memory.dmp
memory/1628-19-0x00007FFB24820000-0x00007FFB252E1000-memory.dmp
memory/1628-12-0x00000259D5910000-0x00000259D5932000-memory.dmp
memory/1628-14-0x00000259EDE40000-0x00000259EDE50000-memory.dmp
memory/1628-13-0x00007FFB24820000-0x00007FFB252E1000-memory.dmp
memory/1760-71-0x00007FFB24820000-0x00007FFB252E1000-memory.dmp
memory/1760-69-0x0000021877C70000-0x0000021877C80000-memory.dmp
memory/1760-58-0x0000021877C70000-0x0000021877C80000-memory.dmp
memory/1760-57-0x0000021877C70000-0x0000021877C80000-memory.dmp
memory/1760-56-0x00007FFB24820000-0x00007FFB252E1000-memory.dmp
memory/3056-50-0x000001DD1B580000-0x000001DD1B590000-memory.dmp
memory/3056-52-0x000001DD1B580000-0x000001DD1B590000-memory.dmp
memory/3056-49-0x000001DD1B580000-0x000001DD1B590000-memory.dmp
memory/3056-55-0x00007FFB24820000-0x00007FFB252E1000-memory.dmp
memory/3056-48-0x00007FFB24820000-0x00007FFB252E1000-memory.dmp
memory/4252-21-0x00007FFB24820000-0x00007FFB252E1000-memory.dmp
memory/4252-37-0x00007FFB24820000-0x00007FFB252E1000-memory.dmp
memory/4252-35-0x00000250FAFC0000-0x00000250FAFD0000-memory.dmp
memory/4252-34-0x00000250FAFC0000-0x00000250FAFD0000-memory.dmp
memory/4252-22-0x00000250FAFC0000-0x00000250FAFD0000-memory.dmp
memory/4252-23-0x00000250FAFC0000-0x00000250FAFD0000-memory.dmp