Analysis

  • max time kernel
    146s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    26-05-2024 14:59

General

  • Target

    XClient.exe

  • Size

    178KB

  • MD5

    f77e3c044bfaa316282635c965671e0d

  • SHA1

    4b2dd8aaa5d35e348c5dc4a9db7a6ad8cf611566

  • SHA256

    da22cbb2cfd0a80a91deb74a01a1c7750629952cafb9e2a253686ec93fcd3c18

  • SHA512

    8da3ad0b3c57537007f4d913a958e7c956d01d9a72956030bcc5e2b4edf3c10ad532f43745533ad1c58009d73b47a1fadc285efe7ed46fa2deb711dd2015e7d1

  • SSDEEP

    3072:43ePccS5wEsJQlTJblxxx1VhOfJ+JTvxBz65/M6If+3Js+3JFkKeTno:4VzfTJblvzVJTZxBt25

Malware Config

Extracted

Family

xworm

C2

enough-washer.gl.at.ply.gg:64300

Attributes
  • install_file

    USB.exe

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1444
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2712
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3032

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

    Filesize

    7KB

    MD5

    f3ac2181cf6ecebf4134de3b910c0cfa

    SHA1

    80dfd29d063cd2715bd0959077adb9fd050b15bc

    SHA256

    12d5a48792caee398cff706bf405e3214fe6aff45b8900634d7fd3b350fba3f7

    SHA512

    f6c2da0f535590ed4b7e8bb828dd0d81c93e5878c32710c36182fead105b6c0a6e9e9652ba837a28762d52be0e1d2327e93ada70220338246b424ebf805d5b4b

  • memory/1444-17-0x000007FEF59B0000-0x000007FEF639C000-memory.dmp

    Filesize

    9.9MB

  • memory/1444-1-0x0000000001170000-0x00000000011A2000-memory.dmp

    Filesize

    200KB

  • memory/1444-2-0x000007FEF59B0000-0x000007FEF639C000-memory.dmp

    Filesize

    9.9MB

  • memory/1444-0-0x000007FEF59B3000-0x000007FEF59B4000-memory.dmp

    Filesize

    4KB

  • memory/1444-20-0x000000001B620000-0x000000001B6D0000-memory.dmp

    Filesize

    704KB

  • memory/1444-19-0x0000000000E00000-0x0000000000E0E000-memory.dmp

    Filesize

    56KB

  • memory/1444-18-0x0000000000DD0000-0x0000000000DDC000-memory.dmp

    Filesize

    48KB

  • memory/1444-16-0x000007FEF59B3000-0x000007FEF59B4000-memory.dmp

    Filesize

    4KB

  • memory/2712-7-0x000000001B650000-0x000000001B932000-memory.dmp

    Filesize

    2.9MB

  • memory/2712-8-0x0000000002290000-0x0000000002298000-memory.dmp

    Filesize

    32KB

  • memory/3032-15-0x00000000022D0000-0x00000000022D8000-memory.dmp

    Filesize

    32KB

  • memory/3032-14-0x000000001B790000-0x000000001BA72000-memory.dmp

    Filesize

    2.9MB