General

  • Target

    XClient.exe

  • Size

    91KB

  • Sample

    240527-amds8sac78

  • MD5

    dec4c5a5a60c099342431b3aca4ede4e

  • SHA1

    9b5175bf348760857fe525bc6af0a16b10e17139

  • SHA256

    e5447e7c675b0adf08306201e60ba911a7a549a82803207f2c5fb551d1ca1020

  • SHA512

    415b66ad8acaaafe1d19b247c057fefd642edd5e9d3a82f29a8d0a9d466c847759d8e820ca242badc2da36271679db176319dd6dc04dae00c16da431de404f92

  • SSDEEP

    1536:hlzOpgzRXhKIBqE8mlrbTAbT+7zHEyHAt6DWfr6YONkdYVVH:8axemlrbTAbKzHNgdrlONkdYVd

Malware Config

Extracted

Family

xworm

C2

uk2.localto.net:4782

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    $77-Powershell.exe

Targets

    • Target

      XClient.exe

    • Size

      91KB

    • MD5

      dec4c5a5a60c099342431b3aca4ede4e

    • SHA1

      9b5175bf348760857fe525bc6af0a16b10e17139

    • SHA256

      e5447e7c675b0adf08306201e60ba911a7a549a82803207f2c5fb551d1ca1020

    • SHA512

      415b66ad8acaaafe1d19b247c057fefd642edd5e9d3a82f29a8d0a9d466c847759d8e820ca242badc2da36271679db176319dd6dc04dae00c16da431de404f92

    • SSDEEP

      1536:hlzOpgzRXhKIBqE8mlrbTAbT+7zHEyHAt6DWfr6YONkdYVVH:8axemlrbTAbKzHNgdrlONkdYVd

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks