Analysis
- max time kernel
1799s - max time network
1805s - platform
windows10-2004_x64 - resource
win10v2004-20240319-en - resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system - submitted
01/04/2024, 22:54
Behavioral task
behavioral1
Sample
XClient.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
1800 seconds
General
- Target XClient.exe
- Size 63KB
- Sample240401-2vmvnahh89
- SHA256 fb1306e879286135143e822d17e2bf0f2531e5bf2b88f89f97878399a4ade592
- MD5 93e870b046ca444a02ac0352ec340c24
- SHA1 7a1d6f0a3218f7314dc7735381359e0e5e9b7636
- SHA512 c7bb8c097974f71dcd73af1aa4a34daeb2a0b2565dfc913e91f3123cf8faa075433b102af2f4fe2af31e5070e53ba636575f2ccce396ab1e9a0e2ed5a0df3138
- SSDEEP 1536:XTW+TuDEinvXdzqPUPdSVjQbheQu3PO8jzOT2zg:XFTuDEiFzq0dSVsbhe/G8jzOTr
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
xworm
C2
-
147.185.221.16:40164
Attributes
-
install_file
USB.exe
Signatures
- Detect Xworm Payload 1 IoCs
resource yara_rule behavioral2/memory/3048-0-0x00000000005A0000-0x00000000005B6000-memory.dmp family_xworm - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 29 ip-api.com - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2344 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3048 XClient.exe Token: SeDebugPrivilege 2344 taskmgr.exe Token: SeSystemProfilePrivilege 2344 taskmgr.exe Token: SeCreateGlobalPrivilege 2344 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe 2344 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3048
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2344
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2252,i,3429015581403167983,2708022432612919502,262144 --variations-seed-version /prefetch:81⤵PID:5580
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3772 --field-trial-handle=2252,i,3429015581403167983,2708022432612919502,262144 --variations-seed-version /prefetch:81⤵PID:5804