Resubmissions
31-05-2024 08:26
240531-kb5gxscc8t 1030-05-2024 13:27
240530-qp8dmaab3y 1030-05-2024 11:10
240530-m9qgrsfb9x 10Analysis
-
max time kernel
114s -
max time network
109s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
30-05-2024 13:27
Behavioral task
behavioral1
Sample
XClient.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
XClient.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
XClient.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
XClient.exe
Resource
win11-20240426-en
General
-
Target
XClient.exe
-
Size
62KB
-
MD5
3f171ed4261c46329a1bcc62ebb19519
-
SHA1
06768df330b8012ee3d0cb22723408636ba7c17a
-
SHA256
3c096dc60917ae1e47a754fd578882f1286ee9114ff5c6558b4f84f0be69076f
-
SHA512
81e90ab476967a8ca6b88f8060fe72b56450dae6300adfbcef346dfb4c523e054da05d192209ff53771a8b49ad6a6922151d905a5a6bbc8decfe551ab757a06d
-
SSDEEP
1536:1RE9Nr0ZWB8lQkagw9DC1oTnNbSkoRek+OUpS:1RE9NQZWB8XaguCWNbSHwk+OUE
Malware Config
Extracted
xworm
3.0
scamov-48667.portmap.host:48667
-
Install_directory
%LocalAppData%
-
install_file
Cheat.exe
-
telegram
https://api.telegram.org/bot6992734078:AAE3Znug3pzwyvwxKrzRk75x1dHIdnYHy4Q/sendMessage?chat_id=6790913039
Signatures
-
Detect Xworm Payload 2 IoCs
Processes:
resource yara_rule behavioral4/memory/784-1-0x0000000000B80000-0x0000000000B96000-memory.dmp family_xworm C:\Users\Admin\AppData\Local\XClient.exe family_xworm -
Drops startup file 2 IoCs
Processes:
XClient.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk XClient.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk XClient.exe -
Executes dropped EXE 2 IoCs
Processes:
XClient.exeXClient.exepid process 1028 XClient.exe 1888 XClient.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
XClient.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Local\\XClient.exe" XClient.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
XClient.exepid process 784 XClient.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
XClient.exeXClient.exeXClient.exedescription pid process Token: SeDebugPrivilege 784 XClient.exe Token: SeDebugPrivilege 784 XClient.exe Token: SeDebugPrivilege 1028 XClient.exe Token: SeDebugPrivilege 1888 XClient.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
XClient.exedescription pid process target process PID 784 wrote to memory of 408 784 XClient.exe schtasks.exe PID 784 wrote to memory of 408 784 XClient.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Local\XClient.exe"2⤵
- Creates scheduled task(s)
PID:408
-
-
C:\Users\Admin\AppData\Local\XClient.exeC:\Users\Admin\AppData\Local\XClient.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1028
-
C:\Users\Admin\AppData\Local\XClient.exeC:\Users\Admin\AppData\Local\XClient.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1888
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
654B
MD52cbbb74b7da1f720b48ed31085cbd5b8
SHA179caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA256e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
SHA512ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9
-
Filesize
62KB
MD53f171ed4261c46329a1bcc62ebb19519
SHA106768df330b8012ee3d0cb22723408636ba7c17a
SHA2563c096dc60917ae1e47a754fd578882f1286ee9114ff5c6558b4f84f0be69076f
SHA51281e90ab476967a8ca6b88f8060fe72b56450dae6300adfbcef346dfb4c523e054da05d192209ff53771a8b49ad6a6922151d905a5a6bbc8decfe551ab757a06d