Resubmissions
31-05-2024 08:26
240531-kb5gxscc8t 1030-05-2024 13:27
240530-qp8dmaab3y 1030-05-2024 11:10
240530-m9qgrsfb9x 10Analysis
-
max time kernel
111s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30-05-2024 11:10
Behavioral task
behavioral1
Sample
XClient.exe
Resource
win10v2004-20240508-en
General
-
Target
XClient.exe
-
Size
62KB
-
MD5
3f171ed4261c46329a1bcc62ebb19519
-
SHA1
06768df330b8012ee3d0cb22723408636ba7c17a
-
SHA256
3c096dc60917ae1e47a754fd578882f1286ee9114ff5c6558b4f84f0be69076f
-
SHA512
81e90ab476967a8ca6b88f8060fe72b56450dae6300adfbcef346dfb4c523e054da05d192209ff53771a8b49ad6a6922151d905a5a6bbc8decfe551ab757a06d
-
SSDEEP
1536:1RE9Nr0ZWB8lQkagw9DC1oTnNbSkoRek+OUpS:1RE9NQZWB8XaguCWNbSHwk+OUE
Malware Config
Extracted
xworm
3.0
scamov-48667.portmap.host:48667
-
Install_directory
%LocalAppData%
-
install_file
Cheat.exe
-
telegram
https://api.telegram.org/bot6992734078:AAE3Znug3pzwyvwxKrzRk75x1dHIdnYHy4Q/sendMessage?chat_id=6790913039
Signatures
-
Detect Xworm Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1072-1-0x00000000002E0000-0x00000000002F6000-memory.dmp family_xworm C:\Users\Admin\AppData\Local\XClient.exe family_xworm -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
XClient.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation XClient.exe -
Drops startup file 2 IoCs
Processes:
XClient.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk XClient.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk XClient.exe -
Executes dropped EXE 2 IoCs
Processes:
XClient.exeXClient.exepid process 3308 XClient.exe 3536 XClient.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
XClient.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Local\\XClient.exe" XClient.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 15 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 1 IoCs
Processes:
taskmgr.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
XClient.exepid process 1072 XClient.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exepid process 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 4804 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
XClient.exeXClient.exetaskmgr.exeXClient.exeXClient.exedescription pid process Token: SeDebugPrivilege 1072 XClient.exe Token: SeDebugPrivilege 1072 XClient.exe Token: SeDebugPrivilege 3308 XClient.exe Token: SeDebugPrivilege 4804 taskmgr.exe Token: SeSystemProfilePrivilege 4804 taskmgr.exe Token: SeCreateGlobalPrivilege 4804 taskmgr.exe Token: SeDebugPrivilege 3536 XClient.exe Token: SeDebugPrivilege 3976 XClient.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe 4804 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
XClient.exedescription pid process target process PID 1072 wrote to memory of 748 1072 XClient.exe schtasks.exe PID 1072 wrote to memory of 748 1072 XClient.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Local\XClient.exe"2⤵
- Creates scheduled task(s)
PID:748
-
-
C:\Users\Admin\AppData\Local\XClient.exeC:\Users\Admin\AppData\Local\XClient.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3308
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4804
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:512
-
C:\Users\Admin\AppData\Local\XClient.exeC:\Users\Admin\AppData\Local\XClient.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3536
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3976
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
62KB
MD53f171ed4261c46329a1bcc62ebb19519
SHA106768df330b8012ee3d0cb22723408636ba7c17a
SHA2563c096dc60917ae1e47a754fd578882f1286ee9114ff5c6558b4f84f0be69076f
SHA51281e90ab476967a8ca6b88f8060fe72b56450dae6300adfbcef346dfb4c523e054da05d192209ff53771a8b49ad6a6922151d905a5a6bbc8decfe551ab757a06d
-
Filesize
966B
MD550247afc42bb4334b6bf24ae1226fca8
SHA1427cc9926171a22d59d561d9bd3c144e42b92d27
SHA2568c912e7eeae0d377c73959167f89d55e276c0e017540ba1a7827a1afa9e580bc
SHA5124444ae0d4c6ce969a038f763b4de4f728e9222e870f53db1973940e3ca4885f4bfc91d7094c633bbd2edf371e3f2c4fae0104eaf06c2d606cbfed0473fee3a94