Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-05-2024 11:04

General

  • Target

    XClient.exe

  • Size

    61KB

  • MD5

    892ddc6e9fc78113c7cd7c863b97408f

  • SHA1

    4d4f1cd50caa21962f66494187c6482dce436545

  • SHA256

    6433a2e6533a9d6789e46c3760e99d63a4ad493a9e9ea035fbb417440e983a51

  • SHA512

    cafe8efc2a2b72b1c7b9f31ba95c4b439318bbc8e5912bf7bd38f8e226c35c560d6d1d974a95a1dbecc371c5652003143d62bb741c0def249fabbd6c33685d64

  • SSDEEP

    1536:V3oAlJbb147e36CMrBVbBVwE6BOWHaNI:BoAzG7zjbBQOKwI

Malware Config

Extracted

Family

xworm

C2

registered-martial.gl.at.ply.gg:62460

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2828
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4924
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4040
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:744
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1964
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
      2⤵
      • Creates scheduled task(s)
      PID:3904
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3028
    • C:\Users\Admin\AppData\Roaming\XClient.exe
      C:\Users\Admin\AppData\Roaming\XClient.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4468
    • C:\Users\Admin\AppData\Roaming\XClient.exe
      C:\Users\Admin\AppData\Roaming\XClient.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1376
    • C:\Users\Admin\AppData\Roaming\XClient.exe
      C:\Users\Admin\AppData\Roaming\XClient.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1504

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XClient.exe.log

      Filesize

      654B

      MD5

      2ff39f6c7249774be85fd60a8f9a245e

      SHA1

      684ff36b31aedc1e587c8496c02722c6698c1c4e

      SHA256

      e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

      SHA512

      1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      d85ba6ff808d9e5444a4b369f5bc2730

      SHA1

      31aa9d96590fff6981b315e0b391b575e4c0804a

      SHA256

      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

      SHA512

      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      2979eabc783eaca50de7be23dd4eafcf

      SHA1

      d709ce5f3a06b7958a67e20870bfd95b83cad2ea

      SHA256

      006cca90e78fbb571532a83082ac6712721a34ea4b21f490058ffb3f521f4903

      SHA512

      92bc433990572d9427d0c93eef9bd1cc23fa00ed60dd0c9c983d87d3421e02ce3f156c6f88fe916ef6782dbf185cbce083bc0094f8c527f302be6a37d1c53aba

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      6f3b96b24f06e2d37a46e43e8b784f56

      SHA1

      7be6702c5867f359e913eeeecdd5b76698589295

      SHA256

      8e386afeed28e1d282d9a0294dd2e9402dcb807f7c77aca8426314c20057e720

      SHA512

      d760999531a77a9adf2b4dc019ce3b43ac3a8cad825398b3a09818afe8deaa177d37219a26dd8a432c00c9cff7858efc43cae2375edc996bb0136c92c39c9dfb

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      607d8291c717d0b40e63a94c2819c4db

      SHA1

      cf1eefbbc5414144d227da05df4eebb71d86f029

      SHA256

      fe5792b7330b409db25fb4eacb6d57bb56798959122319107f9faa69dd9de2cc

      SHA512

      f480466e8b0fc939189eb6d0efb17484922c88fa8af5adbc6c2ec031bc6e2a2a20ae7b223f7724d4171a06253321dbaad147238bf1fd2694ead717dd29a414ee

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bijkzuvq.hpg.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Roaming\XClient.exe

      Filesize

      61KB

      MD5

      892ddc6e9fc78113c7cd7c863b97408f

      SHA1

      4d4f1cd50caa21962f66494187c6482dce436545

      SHA256

      6433a2e6533a9d6789e46c3760e99d63a4ad493a9e9ea035fbb417440e983a51

      SHA512

      cafe8efc2a2b72b1c7b9f31ba95c4b439318bbc8e5912bf7bd38f8e226c35c560d6d1d974a95a1dbecc371c5652003143d62bb741c0def249fabbd6c33685d64

    • memory/2828-60-0x00007FF8EF1A0000-0x00007FF8EFC61000-memory.dmp

      Filesize

      10.8MB

    • memory/2828-59-0x00007FF8EF1A3000-0x00007FF8EF1A5000-memory.dmp

      Filesize

      8KB

    • memory/2828-0-0x00007FF8EF1A3000-0x00007FF8EF1A5000-memory.dmp

      Filesize

      8KB

    • memory/2828-57-0x000000001BD10000-0x000000001BE12000-memory.dmp

      Filesize

      1.0MB

    • memory/2828-2-0x00007FF8EF1A0000-0x00007FF8EFC61000-memory.dmp

      Filesize

      10.8MB

    • memory/2828-1-0x0000000000A70000-0x0000000000A86000-memory.dmp

      Filesize

      88KB

    • memory/4924-12-0x0000023136D80000-0x0000023136DA2000-memory.dmp

      Filesize

      136KB

    • memory/4924-18-0x00007FF8EF1A0000-0x00007FF8EFC61000-memory.dmp

      Filesize

      10.8MB

    • memory/4924-15-0x00007FF8EF1A0000-0x00007FF8EFC61000-memory.dmp

      Filesize

      10.8MB

    • memory/4924-14-0x00007FF8EF1A0000-0x00007FF8EFC61000-memory.dmp

      Filesize

      10.8MB

    • memory/4924-13-0x00007FF8EF1A0000-0x00007FF8EFC61000-memory.dmp

      Filesize

      10.8MB