Analysis

  • max time kernel
    233s
  • max time network
    296s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-05-2024 12:28

General

  • Target

    XClient.exe

  • Size

    62KB

  • MD5

    ec8785fe24a3652b48f3c26305fbe895

  • SHA1

    55d19ee15841fc8f9862d1c5eed0884b7c0b4363

  • SHA256

    43acaa8dd6ef2afc04a0c5de6b4c6ffb879e79af8c4ebcc033c9a230ffa7944a

  • SHA512

    20e792dfe3d50159bc67267ab067dbdf4b29c52cd865bb7fbacfcb6e1b0a52a10a9fe5efb09b3f074c01b06feb8354ee293ecdb0b1c843e530f6d2cd2278824d

  • SSDEEP

    1536:mI/gDbWOkAlgI7RxE6kkbftYV5j6M5O5Jf7:mIAiAlN7RxEVkbfOhO5R7

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %AppData%

  • install_file

    Runtime Broker.exe

  • pastebin_url

    https://pastebin.com/raw/kYPYyCCf

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2432
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:668
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1988
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Runtime Broker.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2300
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Runtime Broker.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2484
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Runtime Broker" /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
      2⤵
      • Creates scheduled task(s)
      PID:4940
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /delete /f /tn "Runtime Broker"
      2⤵
        PID:1988
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3605.tmp.bat""
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1912
        • C:\Windows\system32\timeout.exe
          timeout 3
          3⤵
          • Delays execution with timeout.exe
          PID:232
    • C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
      "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:452
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:2392
      • C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:444

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Runtime Broker.exe.log

        Filesize

        654B

        MD5

        2ff39f6c7249774be85fd60a8f9a245e

        SHA1

        684ff36b31aedc1e587c8496c02722c6698c1c4e

        SHA256

        e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

        SHA512

        1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

        Filesize

        2KB

        MD5

        d85ba6ff808d9e5444a4b369f5bc2730

        SHA1

        31aa9d96590fff6981b315e0b391b575e4c0804a

        SHA256

        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

        SHA512

        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        944B

        MD5

        62623d22bd9e037191765d5083ce16a3

        SHA1

        4a07da6872672f715a4780513d95ed8ddeefd259

        SHA256

        95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

        SHA512

        9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        944B

        MD5

        4f473e15a0686d0c819ad40b5f232368

        SHA1

        a769892ae2e8203e7d4a992a317189b56723da33

        SHA256

        53d6c0d9a801d45fefdcec9b3ecf217fef683efc4e40ba9c72f0116ee4d20237

        SHA512

        d9b43132432078d5496688717253e58e7caab0dcbd20fc41fa8a718d11d699e93ee198f18be4243ed34bcf8912e1377888fe72ae5b26d920e765ab523f0bdf55

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        944B

        MD5

        50d3033f2bc3a3774c469d03e71a79a9

        SHA1

        22027b1d52085de99b3bffa276530fea5d961471

        SHA256

        2987e99ec7fa17bd4ab7de3cb4dc62645e1052012a5a357904d6fc6db9054147

        SHA512

        ecf7ab1a9e4192454a3e24c60453fd702a8c648e00078fc933b9182f4a3d3c10c6f5da622a5729b35727e6ddc8837029caddcaf76f56e805b9744253b56da5d8

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oonmdl4j.35k.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Local\Temp\tmp3605.tmp.bat

        Filesize

        159B

        MD5

        aeb8f9994d906674bf3b2399b4c5eeb2

        SHA1

        70a97c3e9bccc9194f35a89cbc3811546910ccf0

        SHA256

        7e7cd6272bf38d3505a88365408e0b226afc409c5c953e2c86f4e9d33a657425

        SHA512

        95bc024726e96c20bbc44b67b525d50f8ada5af32ac6daa4a102cfcf6ef0660cd2fae351ae4b03c60a96a4aee855f8a8d3c806762cc001416bbf3620bf3837ba

      • C:\Users\Admin\AppData\Roaming\Runtime Broker.exe

        Filesize

        62KB

        MD5

        ec8785fe24a3652b48f3c26305fbe895

        SHA1

        55d19ee15841fc8f9862d1c5eed0884b7c0b4363

        SHA256

        43acaa8dd6ef2afc04a0c5de6b4c6ffb879e79af8c4ebcc033c9a230ffa7944a

        SHA512

        20e792dfe3d50159bc67267ab067dbdf4b29c52cd865bb7fbacfcb6e1b0a52a10a9fe5efb09b3f074c01b06feb8354ee293ecdb0b1c843e530f6d2cd2278824d

      • memory/668-18-0x00007FF82DDE0000-0x00007FF82E8A1000-memory.dmp

        Filesize

        10.8MB

      • memory/668-15-0x00007FF82DDE0000-0x00007FF82E8A1000-memory.dmp

        Filesize

        10.8MB

      • memory/668-14-0x00007FF82DDE0000-0x00007FF82E8A1000-memory.dmp

        Filesize

        10.8MB

      • memory/668-13-0x00007FF82DDE0000-0x00007FF82E8A1000-memory.dmp

        Filesize

        10.8MB

      • memory/668-12-0x00007FF82DDE0000-0x00007FF82E8A1000-memory.dmp

        Filesize

        10.8MB

      • memory/668-11-0x0000019902990000-0x00000199029B2000-memory.dmp

        Filesize

        136KB

      • memory/2432-57-0x00007FF82DDE3000-0x00007FF82DDE5000-memory.dmp

        Filesize

        8KB

      • memory/2432-58-0x00007FF82DDE0000-0x00007FF82E8A1000-memory.dmp

        Filesize

        10.8MB

      • memory/2432-0-0x00007FF82DDE3000-0x00007FF82DDE5000-memory.dmp

        Filesize

        8KB

      • memory/2432-62-0x00007FF82DDE0000-0x00007FF82E8A1000-memory.dmp

        Filesize

        10.8MB

      • memory/2432-71-0x00007FF82DDE0000-0x00007FF82E8A1000-memory.dmp

        Filesize

        10.8MB

      • memory/2432-1-0x00000000001A0000-0x00000000001B6000-memory.dmp

        Filesize

        88KB