Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30-05-2024 10:58
Behavioral task
behavioral1
Sample
7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exe
Resource
win10v2004-20240508-en
General
-
Target
7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exe
-
Size
71KB
-
MD5
d5af9923e3015fc2cd381797720e84ec
-
SHA1
8a11d55d97ad484897fd8da7c7e36543184ef23d
-
SHA256
7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607
-
SHA512
11fc191532a6a8a643531aeb90b30a18830bb904b898cb66d6e068cd887b0658b3e6edc75a6c2c622fe0bc0329fac720af43a933a724ccab4c27fa92865307cb
-
SSDEEP
1536:FTIATUQ2TVMAQuPjcg0OPhb8YUzQjDb6TyBmcOrdzBLvVKhy2:FPuaAPPqOpb88jD0yJOhBzQz
Malware Config
Extracted
xworm
registered-martial.gl.at.ply.gg:62460
-
Install_directory
%Temp%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4808-1-0x0000000000740000-0x0000000000758000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 452 powershell.exe 1796 powershell.exe 1652 powershell.exe 1300 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XClient.exe" 7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 22 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exe7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exepid process 452 powershell.exe 452 powershell.exe 1796 powershell.exe 1796 powershell.exe 1652 powershell.exe 1652 powershell.exe 1300 powershell.exe 1300 powershell.exe 4808 7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 4808 7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exe Token: SeDebugPrivilege 452 powershell.exe Token: SeDebugPrivilege 1796 powershell.exe Token: SeDebugPrivilege 1652 powershell.exe Token: SeDebugPrivilege 1300 powershell.exe Token: SeDebugPrivilege 4808 7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exepid process 4808 7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exedescription pid process target process PID 4808 wrote to memory of 452 4808 7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exe powershell.exe PID 4808 wrote to memory of 452 4808 7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exe powershell.exe PID 4808 wrote to memory of 1796 4808 7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exe powershell.exe PID 4808 wrote to memory of 1796 4808 7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exe powershell.exe PID 4808 wrote to memory of 1652 4808 7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exe powershell.exe PID 4808 wrote to memory of 1652 4808 7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exe powershell.exe PID 4808 wrote to memory of 1300 4808 7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exe powershell.exe PID 4808 wrote to memory of 1300 4808 7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exe"C:\Users\Admin\AppData\Local\Temp\7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:452
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1796
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1652
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1300
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD515dde0683cd1ca19785d7262f554ba93
SHA1d039c577e438546d10ac64837b05da480d06bf69
SHA256d6fa39eab7ee36f44dc3f9f2839d098433db95c1eba924e4bcf4e5c0d268d961
SHA51257c0e1b87bc1c136f0d39f3ce64bb8f8274a0491e4ca6e45e5c7f9070aa9d9370c6f590ce37cd600b252df2638d870205249a514c43245ca7ed49017024a4672
-
Filesize
944B
MD53505effaead0f06d098f1aec01836881
SHA194bafdbeb2f5adbd8cec709574df5b8dbcc5eba3
SHA2565d39a25ff8842c7c14aa14f99c5e3e1606fb7516c57f03dc41069df3c3de0517
SHA512934d8eab5bc2ec20e800c668f3c3434829feade4771918a22d712f7ba39f91f93877a1e9dc1beac966646af0c9dd2cf118041535143b3abc585fea8dfb1299f5
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82