Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-05-2024 01:44

General

  • Target

    e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe

  • Size

    494KB

  • MD5

    0f2eaea796ec4d932ac2d94c61f6b60d

  • SHA1

    bd5f3e5043afebcc1c08e763ab8afc0183f5b7f7

  • SHA256

    e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51

  • SHA512

    addee2ef8b337d2241da0a4fd02e378365e5bb998b1e7603821a91723cc0a4d7c3dee99ba2f016df227d2a5c84ef1939aa4a72dbfc595b788195cdc2025bf69c

  • SSDEEP

    6144:w9BrlrV1JwKcZKGq1uNYCa8Z5gG02jjQFv5jeARhB7KW4x86H+wXCprgT5pbV+f:wbBPJwKcIfoKChzPuj7D+xUprgTn8

Malware Config

Extracted

Family

xworm

C2

104.250.180.178:7061

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Detects Windows executables referencing non-Windows User-Agents 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe
    "C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2728
    • C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe
      "C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe"
      2⤵
        PID:4152
      • C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe
        "C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe"
        2⤵
        • Checks computer location settings
        • Drops startup file
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1616
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2000
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3416
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3044
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2464

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe.log

      Filesize

      1KB

      MD5

      8ec831f3e3a3f77e4a7b9cd32b48384c

      SHA1

      d83f09fd87c5bd86e045873c231c14836e76a05c

      SHA256

      7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

      SHA512

      26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      968cb9309758126772781b83adb8a28f

      SHA1

      8da30e71accf186b2ba11da1797cf67f8f78b47c

      SHA256

      92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

      SHA512

      4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      fd4b1530a1446024ef5299ef6f00025e

      SHA1

      bc3b8ca870d3a3536422f92b50221da66c9f8531

      SHA256

      ef988f28b935a54e7a5a477fecaf06e3ec645722477ea0cfc752a72026a02481

      SHA512

      035be0684a81b578a45ea6dab376dfe25bcd28f4330a7b4671c9cffbc5fda29764382533ff769a5a809b746e98eb01cf1a554702a1c0afb079718b15b5ccb064

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      8dc6cf123e290e505eac3107c4a9b3e9

      SHA1

      bec38f764e3260469894afc8b5c7a6679c59455e

      SHA256

      940dfab6b15b279eeef2c729c7fef6ccf39e0407a50971426ea4ae7bb58dcbc2

      SHA512

      c2053918b79d953a88235e50a49b17b8c43dad4a52a92523a9365006db94398d74724b442428e3b05b0b7af7e9e5340c23c73e28e96654341e9c4dfec50b2d74

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      a7f576d67137e1ffb2c7ef5d3e7dfb74

      SHA1

      34c9a92fc7273813934b5d8a84847564f3d61f26

      SHA256

      dec57f9c288c8e86104ab18df4b1dc3d573ffaaffad49579025b656b8823face

      SHA512

      bedea892454cb8ee7b3d43c55f96bc142ad5b9cf788bbbdef3a5d6e1ac2766efb95d3c756de86772d03a94077e2e5e8b3c11b200977bcb676b3fa51be7588311

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_khwvehps.pjh.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • memory/1616-10-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB

    • memory/1616-13-0x0000000074F10000-0x00000000756C0000-memory.dmp

      Filesize

      7.7MB

    • memory/1616-130-0x0000000074F10000-0x00000000756C0000-memory.dmp

      Filesize

      7.7MB

    • memory/1616-129-0x0000000074F10000-0x00000000756C0000-memory.dmp

      Filesize

      7.7MB

    • memory/1616-128-0x0000000074F10000-0x00000000756C0000-memory.dmp

      Filesize

      7.7MB

    • memory/2000-35-0x0000000006CD0000-0x0000000006D02000-memory.dmp

      Filesize

      200KB

    • memory/2000-50-0x0000000007A70000-0x0000000007A7A000-memory.dmp

      Filesize

      40KB

    • memory/2000-16-0x0000000074F10000-0x00000000756C0000-memory.dmp

      Filesize

      7.7MB

    • memory/2000-17-0x0000000074F10000-0x00000000756C0000-memory.dmp

      Filesize

      7.7MB

    • memory/2000-18-0x00000000057E0000-0x0000000005E08000-memory.dmp

      Filesize

      6.2MB

    • memory/2000-19-0x0000000074F10000-0x00000000756C0000-memory.dmp

      Filesize

      7.7MB

    • memory/2000-20-0x00000000057B0000-0x00000000057D2000-memory.dmp

      Filesize

      136KB

    • memory/2000-21-0x0000000005F00000-0x0000000005F66000-memory.dmp

      Filesize

      408KB

    • memory/2000-22-0x0000000005F70000-0x0000000005FD6000-memory.dmp

      Filesize

      408KB

    • memory/2000-15-0x0000000002DE0000-0x0000000002E16000-memory.dmp

      Filesize

      216KB

    • memory/2000-28-0x00000000060E0000-0x0000000006434000-memory.dmp

      Filesize

      3.3MB

    • memory/2000-33-0x00000000066E0000-0x00000000066FE000-memory.dmp

      Filesize

      120KB

    • memory/2000-34-0x0000000006770000-0x00000000067BC000-memory.dmp

      Filesize

      304KB

    • memory/2000-59-0x0000000074F10000-0x00000000756C0000-memory.dmp

      Filesize

      7.7MB

    • memory/2000-47-0x00000000078C0000-0x0000000007963000-memory.dmp

      Filesize

      652KB

    • memory/2000-46-0x0000000006C70000-0x0000000006C8E000-memory.dmp

      Filesize

      120KB

    • memory/2000-36-0x0000000071180000-0x00000000711CC000-memory.dmp

      Filesize

      304KB

    • memory/2000-49-0x0000000007A00000-0x0000000007A1A000-memory.dmp

      Filesize

      104KB

    • memory/2000-48-0x0000000008050000-0x00000000086CA000-memory.dmp

      Filesize

      6.5MB

    • memory/2000-56-0x0000000007D20000-0x0000000007D28000-memory.dmp

      Filesize

      32KB

    • memory/2000-51-0x0000000007C80000-0x0000000007D16000-memory.dmp

      Filesize

      600KB

    • memory/2000-52-0x0000000007C00000-0x0000000007C11000-memory.dmp

      Filesize

      68KB

    • memory/2000-53-0x0000000007C30000-0x0000000007C3E000-memory.dmp

      Filesize

      56KB

    • memory/2000-54-0x0000000007C40000-0x0000000007C54000-memory.dmp

      Filesize

      80KB

    • memory/2000-55-0x0000000007D40000-0x0000000007D5A000-memory.dmp

      Filesize

      104KB

    • memory/2464-113-0x0000000071180000-0x00000000711CC000-memory.dmp

      Filesize

      304KB

    • memory/2728-1-0x0000000000730000-0x00000000007B2000-memory.dmp

      Filesize

      520KB

    • memory/2728-4-0x0000000005260000-0x000000000526A000-memory.dmp

      Filesize

      40KB

    • memory/2728-3-0x00000000051C0000-0x0000000005252000-memory.dmp

      Filesize

      584KB

    • memory/2728-9-0x0000000006780000-0x00000000067D6000-memory.dmp

      Filesize

      344KB

    • memory/2728-14-0x0000000074F10000-0x00000000756C0000-memory.dmp

      Filesize

      7.7MB

    • memory/2728-2-0x00000000058B0000-0x0000000005E54000-memory.dmp

      Filesize

      5.6MB

    • memory/2728-7-0x0000000005890000-0x00000000058A8000-memory.dmp

      Filesize

      96KB

    • memory/2728-6-0x0000000074F10000-0x00000000756C0000-memory.dmp

      Filesize

      7.7MB

    • memory/2728-0-0x0000000074F1E000-0x0000000074F1F000-memory.dmp

      Filesize

      4KB

    • memory/2728-5-0x00000000054C0000-0x000000000555C000-memory.dmp

      Filesize

      624KB

    • memory/2728-8-0x0000000005600000-0x0000000005610000-memory.dmp

      Filesize

      64KB

    • memory/3044-92-0x0000000071180000-0x00000000711CC000-memory.dmp

      Filesize

      304KB

    • memory/3416-71-0x0000000071180000-0x00000000711CC000-memory.dmp

      Filesize

      304KB