Analysis

  • max time kernel
    148s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    31-05-2024 01:44

General

  • Target

    e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe

  • Size

    494KB

  • MD5

    0f2eaea796ec4d932ac2d94c61f6b60d

  • SHA1

    bd5f3e5043afebcc1c08e763ab8afc0183f5b7f7

  • SHA256

    e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51

  • SHA512

    addee2ef8b337d2241da0a4fd02e378365e5bb998b1e7603821a91723cc0a4d7c3dee99ba2f016df227d2a5c84ef1939aa4a72dbfc595b788195cdc2025bf69c

  • SSDEEP

    6144:w9BrlrV1JwKcZKGq1uNYCa8Z5gG02jjQFv5jeARhB7KW4x86H+wXCprgT5pbV+f:wbBPJwKcIfoKChzPuj7D+xUprgTn8

Malware Config

Extracted

Family

xworm

C2

104.250.180.178:7061

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Signatures

  • Detect Xworm Payload 5 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Detects Windows executables referencing non-Windows User-Agents 5 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops startup file 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe
    "C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2400
    • C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe
      "C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2688
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2792
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2548
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2464
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2196

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    33ac71d4ed9c4992ad83ab69551bb004

    SHA1

    29697ceb57293e7d236a16088fc4c00a39bff3d0

    SHA256

    5e1a467ec7c4cead8e10749b1d337def1b4ff203d38b34845e36768b724c0477

    SHA512

    8ab8eb0c61ce4e4174fde500862635c223b529cd814e7f687e4357698b5f998a1b584ac3455b28050bd02aad9b14ae64853dab17f684b29a9d5b3144940ff18e

  • \??\PIPE\srvsvc

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • \Users\Admin\AppData\Roaming\XClient.exe

    Filesize

    494KB

    MD5

    0f2eaea796ec4d932ac2d94c61f6b60d

    SHA1

    bd5f3e5043afebcc1c08e763ab8afc0183f5b7f7

    SHA256

    e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51

    SHA512

    addee2ef8b337d2241da0a4fd02e378365e5bb998b1e7603821a91723cc0a4d7c3dee99ba2f016df227d2a5c84ef1939aa4a72dbfc595b788195cdc2025bf69c

  • memory/2400-22-0x00000000746F0000-0x0000000074DDE000-memory.dmp

    Filesize

    6.9MB

  • memory/2400-0-0x00000000746FE000-0x00000000746FF000-memory.dmp

    Filesize

    4KB

  • memory/2400-5-0x0000000004360000-0x00000000043B6000-memory.dmp

    Filesize

    344KB

  • memory/2400-1-0x0000000000B80000-0x0000000000C02000-memory.dmp

    Filesize

    520KB

  • memory/2400-2-0x00000000746F0000-0x0000000074DDE000-memory.dmp

    Filesize

    6.9MB

  • memory/2400-4-0x0000000000390000-0x00000000003A0000-memory.dmp

    Filesize

    64KB

  • memory/2400-3-0x00000000004D0000-0x00000000004E8000-memory.dmp

    Filesize

    96KB

  • memory/2688-16-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2688-10-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2688-20-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2688-18-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2688-21-0x00000000746F0000-0x0000000074DDE000-memory.dmp

    Filesize

    6.9MB

  • memory/2688-12-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2688-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2688-8-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2688-6-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2688-47-0x00000000746F0000-0x0000000074DDE000-memory.dmp

    Filesize

    6.9MB

  • memory/2688-48-0x00000000746F0000-0x0000000074DDE000-memory.dmp

    Filesize

    6.9MB

  • memory/2688-49-0x00000000746F0000-0x0000000074DDE000-memory.dmp

    Filesize

    6.9MB