Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-05-2024 01:38

General

  • Target

    cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe

  • Size

    509KB

  • MD5

    ff3aea929347d0168b02de5d2c2bcec3

  • SHA1

    fd7eaa628f424fc1384bcbd926a551c8e60740db

  • SHA256

    cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651

  • SHA512

    c5ba038472b25fa013852b57fa712a286e56a85f015b68c5e7da72ed403aa0b896deb6583407894ae76dc59e90c475a161504d55202b4b7fe774732b22793c3b

  • SSDEEP

    12288:lUrKkGdrJwKcItNXOMaFshRSxD1ulXrvNE53jHd:DcA9NEQlXTaT

Malware Config

Extracted

Family

xworm

C2

104.250.180.178:7061

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Detects Windows executables referencing non-Windows User-Agents 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe
    "C:\Users\Admin\AppData\Local\Temp\cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:764
    • C:\Users\Admin\AppData\Local\Temp\cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe
      "C:\Users\Admin\AppData\Local\Temp\cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:676
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1636
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3224
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4356
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:712

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    968cb9309758126772781b83adb8a28f

    SHA1

    8da30e71accf186b2ba11da1797cf67f8f78b47c

    SHA256

    92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

    SHA512

    4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    155693d37a2ef32e6370db6e1d60ff62

    SHA1

    769f536a50c8bc7a7f699104a68bb6277be521a9

    SHA256

    2a97a665cc13a0cbe7f17058775b6bf74bb82c256b135b4ef3c5d0efad868ea6

    SHA512

    642155820a65af5c70cc099e959ad75c168841f0daa68b6430699d4e8b9b07df1393d9733693d2f122985a3555fb2433231b95963ae7b20d9456d3ca887e1b0f

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    a1b7deab00b9e3ac4e4d32a28767e0f5

    SHA1

    02e4a350ae521d57eae3c1b87e19dc718cd18853

    SHA256

    827761d4f5f4d588912d0918989032df66d026204364abed3c8fff3570e776d2

    SHA512

    2d42c5075997f80527e485d9d77093f538f9d71db33d01aecc535635c65f63f00627263a5278b47ac0c25c07e11b5b6c68216846751f8884bd2617da77ffa4e0

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    cb510602161d9da8cf34c4269fd58305

    SHA1

    5897db5829282cc736f9c85d67ce4892dfe84c5e

    SHA256

    16129b44ae22e4e485f8f5e7be54948f22125d8520a94dcd74606dec0c3484f8

    SHA512

    5dab5cf64f2e742a4e5f3eb5b724483629ee85af0aaa04f499f2786acce31da739aa861f46a26a79699873d88f281afe682ea99577820f4178fb5a5201b96277

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oohhi4qt.z3y.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/676-126-0x0000000074610000-0x0000000074DC0000-memory.dmp

    Filesize

    7.7MB

  • memory/676-127-0x0000000074610000-0x0000000074DC0000-memory.dmp

    Filesize

    7.7MB

  • memory/676-128-0x0000000074610000-0x0000000074DC0000-memory.dmp

    Filesize

    7.7MB

  • memory/676-12-0x0000000074610000-0x0000000074DC0000-memory.dmp

    Filesize

    7.7MB

  • memory/676-10-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/712-111-0x000000006FC30000-0x000000006FC7C000-memory.dmp

    Filesize

    304KB

  • memory/764-9-0x0000000006960000-0x00000000069B6000-memory.dmp

    Filesize

    344KB

  • memory/764-8-0x0000000006740000-0x0000000006750000-memory.dmp

    Filesize

    64KB

  • memory/764-13-0x0000000074610000-0x0000000074DC0000-memory.dmp

    Filesize

    7.7MB

  • memory/764-7-0x0000000006D60000-0x0000000006D78000-memory.dmp

    Filesize

    96KB

  • memory/764-6-0x0000000074610000-0x0000000074DC0000-memory.dmp

    Filesize

    7.7MB

  • memory/764-0-0x000000007461E000-0x000000007461F000-memory.dmp

    Filesize

    4KB

  • memory/764-5-0x00000000055A0000-0x000000000563C000-memory.dmp

    Filesize

    624KB

  • memory/764-4-0x00000000054D0000-0x00000000054DA000-memory.dmp

    Filesize

    40KB

  • memory/764-3-0x0000000005410000-0x00000000054A2000-memory.dmp

    Filesize

    584KB

  • memory/764-2-0x00000000058E0000-0x0000000005E84000-memory.dmp

    Filesize

    5.6MB

  • memory/764-1-0x00000000009B0000-0x0000000000A34000-memory.dmp

    Filesize

    528KB

  • memory/1636-33-0x0000000006F40000-0x0000000006F72000-memory.dmp

    Filesize

    200KB

  • memory/1636-53-0x0000000007FE0000-0x0000000007FFA000-memory.dmp

    Filesize

    104KB

  • memory/1636-31-0x0000000006970000-0x000000000698E000-memory.dmp

    Filesize

    120KB

  • memory/1636-34-0x000000006FC30000-0x000000006FC7C000-memory.dmp

    Filesize

    304KB

  • memory/1636-44-0x0000000006F80000-0x0000000006F9E000-memory.dmp

    Filesize

    120KB

  • memory/1636-45-0x0000000007960000-0x0000000007A03000-memory.dmp

    Filesize

    652KB

  • memory/1636-46-0x00000000082E0000-0x000000000895A000-memory.dmp

    Filesize

    6.5MB

  • memory/1636-47-0x0000000007CA0000-0x0000000007CBA000-memory.dmp

    Filesize

    104KB

  • memory/1636-48-0x0000000007D10000-0x0000000007D1A000-memory.dmp

    Filesize

    40KB

  • memory/1636-49-0x0000000007F20000-0x0000000007FB6000-memory.dmp

    Filesize

    600KB

  • memory/1636-50-0x0000000007EA0000-0x0000000007EB1000-memory.dmp

    Filesize

    68KB

  • memory/1636-51-0x0000000007ED0000-0x0000000007EDE000-memory.dmp

    Filesize

    56KB

  • memory/1636-52-0x0000000007EE0000-0x0000000007EF4000-memory.dmp

    Filesize

    80KB

  • memory/1636-32-0x00000000069A0000-0x00000000069EC000-memory.dmp

    Filesize

    304KB

  • memory/1636-54-0x0000000007FC0000-0x0000000007FC8000-memory.dmp

    Filesize

    32KB

  • memory/1636-57-0x0000000074610000-0x0000000074DC0000-memory.dmp

    Filesize

    7.7MB

  • memory/1636-30-0x0000000006460000-0x00000000067B4000-memory.dmp

    Filesize

    3.3MB

  • memory/1636-20-0x0000000006180000-0x00000000061E6000-memory.dmp

    Filesize

    408KB

  • memory/1636-14-0x00000000053B0000-0x00000000053E6000-memory.dmp

    Filesize

    216KB

  • memory/1636-19-0x00000000060A0000-0x0000000006106000-memory.dmp

    Filesize

    408KB

  • memory/1636-15-0x0000000074610000-0x0000000074DC0000-memory.dmp

    Filesize

    7.7MB

  • memory/1636-18-0x00000000059B0000-0x00000000059D2000-memory.dmp

    Filesize

    136KB

  • memory/1636-17-0x0000000005A70000-0x0000000006098000-memory.dmp

    Filesize

    6.2MB

  • memory/1636-16-0x0000000074610000-0x0000000074DC0000-memory.dmp

    Filesize

    7.7MB

  • memory/3224-69-0x000000006FC30000-0x000000006FC7C000-memory.dmp

    Filesize

    304KB

  • memory/4356-90-0x000000006FC30000-0x000000006FC7C000-memory.dmp

    Filesize

    304KB