Analysis

  • max time kernel
    128s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    26-05-2024 02:26

General

  • Target

    XClient.exe

  • Size

    176KB

  • MD5

    d90b5d4b053571352a95eb0001f02162

  • SHA1

    25b83ffc67f11f95f81e749868829e8f861072c4

  • SHA256

    a97071b70e639c205d450dd22cffdd9d5b4168812dc3bddf63860762b43a922c

  • SHA512

    d5290e756f35f644cb8918073b405b3b7845adbdb1dc64597980317b4d22927717de6f69e8fe131878e5400d47b1bfff033af6a0ff9e86205103e883eac26dfa

  • SSDEEP

    3072:JqPW0E1hGyUHwMkbf2v/PPpOXhv8Bz65/M6If+3Js+3JFkKeTno:JqPW0EbGRjkbQ3MUxBt25

Malware Config

Extracted

Family

xworm

C2

non-activists.gl.at.ply.gg:7000

Attributes
  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2476
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2400
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2552

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\BGY4EP79BSTOZEP4VG9T.temp

    Filesize

    7KB

    MD5

    a71ee6b636ad7a952131d8af9c06a264

    SHA1

    977c4247233748d865f69a9ccad7a1057cfde3ed

    SHA256

    c09e5b4a6ecafd2f2e8e43e4ddc8439f62506d10a9d1fbc20b79b5629d9209d2

    SHA512

    09b1b1372aafe77f1004b055620018ac9c93a1ebcc66e7ca8e9a6852b25bad0a42ed3c9160fc97e9a1672a5655b585f8c2151b37465f2be4889d2384477fc84b

  • memory/2400-9-0x0000000002760000-0x0000000002768000-memory.dmp

    Filesize

    32KB

  • memory/2400-8-0x000000001B560000-0x000000001B842000-memory.dmp

    Filesize

    2.9MB

  • memory/2400-7-0x0000000002660000-0x00000000026E0000-memory.dmp

    Filesize

    512KB

  • memory/2476-0-0x000007FEF5E63000-0x000007FEF5E64000-memory.dmp

    Filesize

    4KB

  • memory/2476-1-0x00000000008C0000-0x00000000008F2000-memory.dmp

    Filesize

    200KB

  • memory/2476-2-0x000007FEF5E60000-0x000007FEF684C000-memory.dmp

    Filesize

    9.9MB

  • memory/2476-17-0x000007FEF5E63000-0x000007FEF5E64000-memory.dmp

    Filesize

    4KB

  • memory/2476-18-0x000007FEF5E60000-0x000007FEF684C000-memory.dmp

    Filesize

    9.9MB

  • memory/2552-15-0x000000001B580000-0x000000001B862000-memory.dmp

    Filesize

    2.9MB

  • memory/2552-16-0x00000000026A0000-0x00000000026A8000-memory.dmp

    Filesize

    32KB