3793639df23de841f332d99a3ef1ff8212a0e0593d415896344b5e54ea1238b6

General

Target

XClient-protected.exe
Size

309KB
MD5

61a9752c153144d46947b2764a098d72
SHA1

d477fd5bf2fdb1bc6f99b538687f75618c53c55f
SHA256

3793639df23de841f332d99a3ef1ff8212a0e0593d415896344b5e54ea1238b6
SHA512

eefe1ad6c60bd340db317c74d5cacc8ce2d9c53c3725d6ca7ea7c5bfefcdf0627a54749d31b6d8fc223cc0f08a7dfc0d2255c548954fc8b6e4fd39b28ef9cc38
SSDEEP

6144:gaWaSdnPm73wByB4zNl8FF/yybIiQXsaIkjRSkYQ:MaSZQ3wByBCNlRiQTjK

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2948	powershell.exe
2572	powershell.exe
2720	powershell.exe
2592	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	XClient-protected.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	XClient-protected.exe

Executes dropped EXE 2 IoCs

pid	Process
2624	svchost.exe
576	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
2924	XClient-protected.exe
2924	XClient-protected.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	XClient-protected.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2988	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
2948	powershell.exe
2572	powershell.exe
2720	powershell.exe
2592	powershell.exe
2924	XClient-protected.exe
2924	XClient-protected.exe
2924	XClient-protected.exe
2924	XClient-protected.exe
2924	XClient-protected.exe
2924	XClient-protected.exe
2924	XClient-protected.exe
2924	XClient-protected.exe
2924	XClient-protected.exe
2924	XClient-protected.exe
2924	XClient-protected.exe
2924	XClient-protected.exe
2924	XClient-protected.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2924	XClient-protected.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeDebugPrivilege	2720	powershell.exe
Token: SeDebugPrivilege	2592	powershell.exe
Token: SeDebugPrivilege	2924	XClient-protected.exe
Token: SeDebugPrivilege	2624	svchost.exe
Token: SeDebugPrivilege	576	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2924	XClient-protected.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2948	2924	XClient-protected.exe	28
PID 2924 wrote to memory of 2948	2924	XClient-protected.exe	28
PID 2924 wrote to memory of 2948	2924	XClient-protected.exe	28
PID 2924 wrote to memory of 2572	2924	XClient-protected.exe	30
PID 2924 wrote to memory of 2572	2924	XClient-protected.exe	30
PID 2924 wrote to memory of 2572	2924	XClient-protected.exe	30
PID 2924 wrote to memory of 2720	2924	XClient-protected.exe	32
PID 2924 wrote to memory of 2720	2924	XClient-protected.exe	32
PID 2924 wrote to memory of 2720	2924	XClient-protected.exe	32
PID 2924 wrote to memory of 2592	2924	XClient-protected.exe	34
PID 2924 wrote to memory of 2592	2924	XClient-protected.exe	34
PID 2924 wrote to memory of 2592	2924	XClient-protected.exe	34
PID 2924 wrote to memory of 2988	2924	XClient-protected.exe	36
PID 2924 wrote to memory of 2988	2924	XClient-protected.exe	36
PID 2924 wrote to memory of 2988	2924	XClient-protected.exe	36
PID 2804 wrote to memory of 2624	2804	taskeng.exe	40
PID 2804 wrote to memory of 2624	2804	taskeng.exe	40
PID 2804 wrote to memory of 2624	2804	taskeng.exe	40
PID 2804 wrote to memory of 576	2804	taskeng.exe	43
PID 2804 wrote to memory of 576	2804	taskeng.exe	43
PID 2804 wrote to memory of 576	2804	taskeng.exe	43

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XClient-protected.exe
"C:\Users\Admin\AppData\Local\Temp\XClient-protected.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient-protected.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient-protected.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2592
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Creates scheduled task(s)
  PID:2988

C:\Windows\system32\taskeng.exe
taskeng.exe {FB4B5919-150E-4DF3-A769-452442702CEE} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Users\Admin\AppData\Roaming\svchost.exe
  C:\Users\Admin\AppData\Roaming\svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2624
- C:\Users\Admin\AppData\Roaming\svchost.exe
  C:\Users\Admin\AppData\Roaming\svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
19b4ceb89e76a3641bc47f9f404cc31e

SHA1
f4af9e078e80c4b5f4f4a1d9a6a4027eaef2f1fc

SHA256
03d82f6401740b0fe7a6cf0cb55952c219417c9853750d4238a3cedc5ad5a140

SHA512
d3d999e8608a2cd5bfff485d5c4ad4d8c148b51ad2efe11ad0c57150c11cb9e93dfd0c618d18f5b8f8ebc51304a1bbfd9d791c5d905a906e2a624631008d93d9

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
309KB

MD5
61a9752c153144d46947b2764a098d72

SHA1
d477fd5bf2fdb1bc6f99b538687f75618c53c55f

SHA256
3793639df23de841f332d99a3ef1ff8212a0e0593d415896344b5e54ea1238b6

SHA512
eefe1ad6c60bd340db317c74d5cacc8ce2d9c53c3725d6ca7ea7c5bfefcdf0627a54749d31b6d8fc223cc0f08a7dfc0d2255c548954fc8b6e4fd39b28ef9cc38

Download Submit
\Users\Admin\AppData\Local\Temp\tmp8823.tmp

Filesize
100KB

MD5
1b942faa8e8b1008a8c3c1004ba57349

SHA1
cd99977f6c1819b12b33240b784ca816dfe2cb91

SHA256
555ccb7ecd9ae52a75135fdd81ab443a49d5785b0621ed6468d28c4234e46ccc

SHA512
5aee3d59478d41ddd5885c99b394c9c4983064e2b3528db1a3f7fc289662bced4f57d072517bbe7573c6d1789435e987ef1aa9cc91f372bcfd30bc016675fa43

Download Submit
memory/576-47-0x0000000000020000-0x0000000000076000-memory.dmp

Filesize
344KB

Download
memory/2572-14-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/2572-15-0x0000000001FC0000-0x0000000001FC8000-memory.dmp

Filesize
32KB

Download
memory/2624-38-0x0000000001180000-0x00000000011D6000-memory.dmp

Filesize
344KB

Download
memory/2924-34-0x000000001AF80000-0x000000001B000000-memory.dmp

Filesize
512KB

Download
memory/2924-32-0x000000001AF80000-0x000000001B000000-memory.dmp

Filesize
512KB

Download
memory/2924-33-0x000007FEF5683000-0x000007FEF5684000-memory.dmp

Filesize
4KB

Download
memory/2924-1-0x00000000010E0000-0x0000000001136000-memory.dmp

Filesize
344KB

Download
memory/2924-0-0x000007FEF5683000-0x000007FEF5684000-memory.dmp

Filesize
4KB

Download
memory/2924-39-0x000000001AB40000-0x000000001AB4C000-memory.dmp

Filesize
48KB

Download
memory/2924-41-0x000000001AF40000-0x000000001AF7A000-memory.dmp

Filesize
232KB

Download
memory/2924-52-0x000000001B020000-0x000000001B02C000-memory.dmp

Filesize
48KB

Download
memory/2948-7-0x000000001B7D0000-0x000000001BAB2000-memory.dmp

Filesize
2.9MB

Download
memory/2948-6-0x0000000002D90000-0x0000000002E10000-memory.dmp

Filesize
512KB

Download
memory/2948-8-0x0000000000440000-0x0000000000448000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads