Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-05-2024 10:58

General

  • Target

    7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exe

  • Size

    71KB

  • MD5

    d5af9923e3015fc2cd381797720e84ec

  • SHA1

    8a11d55d97ad484897fd8da7c7e36543184ef23d

  • SHA256

    7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607

  • SHA512

    11fc191532a6a8a643531aeb90b30a18830bb904b898cb66d6e068cd887b0658b3e6edc75a6c2c622fe0bc0329fac720af43a933a724ccab4c27fa92865307cb

  • SSDEEP

    1536:FTIATUQ2TVMAQuPjcg0OPhb8YUzQjDb6TyBmcOrdzBLvVKhy2:FPuaAPPqOpb88jD0yJOhBzQz

Malware Config

Extracted

Family

xworm

C2

registered-martial.gl.at.ply.gg:62460

Attributes
  • Install_directory

    %Temp%

  • install_file

    XClient.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exe
    "C:\Users\Admin\AppData\Local\Temp\7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4808
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:452
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '7f71385d6a2745866497ffd421c23698a4ba6e0be811d5728d7c0318539ae607.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1796
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1652
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1300

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    d85ba6ff808d9e5444a4b369f5bc2730

    SHA1

    31aa9d96590fff6981b315e0b391b575e4c0804a

    SHA256

    84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

    SHA512

    8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    d28a889fd956d5cb3accfbaf1143eb6f

    SHA1

    157ba54b365341f8ff06707d996b3635da8446f7

    SHA256

    21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

    SHA512

    0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    15dde0683cd1ca19785d7262f554ba93

    SHA1

    d039c577e438546d10ac64837b05da480d06bf69

    SHA256

    d6fa39eab7ee36f44dc3f9f2839d098433db95c1eba924e4bcf4e5c0d268d961

    SHA512

    57c0e1b87bc1c136f0d39f3ce64bb8f8274a0491e4ca6e45e5c7f9070aa9d9370c6f590ce37cd600b252df2638d870205249a514c43245ca7ed49017024a4672

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    3505effaead0f06d098f1aec01836881

    SHA1

    94bafdbeb2f5adbd8cec709574df5b8dbcc5eba3

    SHA256

    5d39a25ff8842c7c14aa14f99c5e3e1606fb7516c57f03dc41069df3c3de0517

    SHA512

    934d8eab5bc2ec20e800c668f3c3434829feade4771918a22d712f7ba39f91f93877a1e9dc1beac966646af0c9dd2cf118041535143b3abc585fea8dfb1299f5

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_puxjephb.zbe.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/452-13-0x00007FFA4C3A0000-0x00007FFA4CE61000-memory.dmp

    Filesize

    10.8MB

  • memory/452-14-0x00007FFA4C3A0000-0x00007FFA4CE61000-memory.dmp

    Filesize

    10.8MB

  • memory/452-15-0x00007FFA4C3A0000-0x00007FFA4CE61000-memory.dmp

    Filesize

    10.8MB

  • memory/452-18-0x00007FFA4C3A0000-0x00007FFA4CE61000-memory.dmp

    Filesize

    10.8MB

  • memory/452-8-0x000001E37EE60000-0x000001E37EE82000-memory.dmp

    Filesize

    136KB

  • memory/4808-0-0x00007FFA4C3A3000-0x00007FFA4C3A5000-memory.dmp

    Filesize

    8KB

  • memory/4808-2-0x00007FFA4C3A0000-0x00007FFA4CE61000-memory.dmp

    Filesize

    10.8MB

  • memory/4808-1-0x0000000000740000-0x0000000000758000-memory.dmp

    Filesize

    96KB

  • memory/4808-54-0x00007FFA4C3A3000-0x00007FFA4C3A5000-memory.dmp

    Filesize

    8KB

  • memory/4808-55-0x00007FFA4C3A0000-0x00007FFA4CE61000-memory.dmp

    Filesize

    10.8MB