Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
31-05-2024 02:32
Behavioral task
behavioral1
Sample
c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exe
Resource
win10v2004-20240426-en
General
-
Target
c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exe
-
Size
276KB
-
MD5
9f14aa0555e80190fe99817d0b3ae058
-
SHA1
d5b77274a0d5cb8a3b17d12b26e8fb48914c6d98
-
SHA256
c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783
-
SHA512
88ea107c23eb017d8dae25d57402a11ccc2660d4860259f40820676aebeef1df920e25d1280eeca5cc24a249d8f654211c752c7ed64399f5d07ef160c6c238e7
-
SSDEEP
6144:zrMRFSb7IdaHvbp/yYtgE6dWltqvMJAF0tWcTPEt8:HMrSbcdgd6YtgP0iU78
Malware Config
Extracted
xworm
-
Install_directory
%AppData%
-
install_file
XClient.exe
-
pastebin_url
https://pastebin.com/raw/819HpC9S
Signatures
-
Detect Xworm Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/5012-1-0x0000000000570000-0x00000000005BA000-memory.dmp family_xworm C:\Users\Admin\AppData\Roaming\XClient.exe family_xworm -
Detects Windows executables referencing non-Windows User-Agents 2 IoCs
Processes:
resource yara_rule behavioral2/memory/5012-1-0x0000000000570000-0x00000000005BA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA C:\Users\Admin\AppData\Roaming\XClient.exe INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 3268 powershell.exe 4848 powershell.exe 2796 powershell.exe 4012 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exe -
Drops startup file 2 IoCs
Processes:
c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exe -
Executes dropped EXE 3 IoCs
Processes:
XClient.exeXClient.exeXClient.exepid process 3804 XClient.exe 1560 XClient.exe 392 XClient.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe" c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
Processes:
flow ioc 17 pastebin.com 18 pastebin.com 28 0.tcp.eu.ngrok.io 51 0.tcp.eu.ngrok.io 67 0.tcp.eu.ngrok.io -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 14 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exec1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exepid process 3268 powershell.exe 3268 powershell.exe 4848 powershell.exe 4848 powershell.exe 2796 powershell.exe 2796 powershell.exe 4012 powershell.exe 4012 powershell.exe 5012 c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exepowershell.exepowershell.exepowershell.exepowershell.exeXClient.exeXClient.exedescription pid process Token: SeDebugPrivilege 5012 c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exe Token: SeDebugPrivilege 3268 powershell.exe Token: SeDebugPrivilege 4848 powershell.exe Token: SeDebugPrivilege 2796 powershell.exe Token: SeDebugPrivilege 4012 powershell.exe Token: SeDebugPrivilege 5012 c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exe Token: SeDebugPrivilege 1560 XClient.exe Token: SeDebugPrivilege 392 XClient.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exepid process 5012 c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exedescription pid process target process PID 5012 wrote to memory of 3268 5012 c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exe powershell.exe PID 5012 wrote to memory of 3268 5012 c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exe powershell.exe PID 5012 wrote to memory of 4848 5012 c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exe powershell.exe PID 5012 wrote to memory of 4848 5012 c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exe powershell.exe PID 5012 wrote to memory of 2796 5012 c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exe powershell.exe PID 5012 wrote to memory of 2796 5012 c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exe powershell.exe PID 5012 wrote to memory of 4012 5012 c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exe powershell.exe PID 5012 wrote to memory of 4012 5012 c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exe powershell.exe PID 5012 wrote to memory of 4140 5012 c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exe schtasks.exe PID 5012 wrote to memory of 4140 5012 c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exe"C:\Users\Admin\AppData\Local\Temp\c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3268
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4848
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2796
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4012
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"2⤵
- Creates scheduled task(s)
PID:4140
-
-
C:\Users\Admin\AppData\Roaming\XClient.exeC:\Users\Admin\AppData\Roaming\XClient.exe1⤵
- Executes dropped EXE
PID:3804
-
C:\Users\Admin\AppData\Roaming\XClient.exeC:\Users\Admin\AppData\Roaming\XClient.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1560
-
C:\Users\Admin\AppData\Roaming\XClient.exeC:\Users\Admin\AppData\Roaming\XClient.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:392
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
944B
MD551cf8df21f531e31f7740b4ec487a48a
SHA140c6a73b22d71625a62df109aefc92a5f9b9d13e
SHA256263d9b98a897d1d66da4832af640c4bf5ab0ae91125ba12243453dfe714f3d0d
SHA51257a85461f6ea96b26a8b53d3a9cca18543e4ddbe996e8f412fc4cf7cf6e9ffe558c96da7b322a42f18bef62020e65aee119bed6102f75e2f605df09b02ec6368
-
Filesize
944B
MD5be67063c62a242565760a02a642a9f02
SHA1d1043a892b44d6676f71b568f578fff947266a19
SHA25656f158298dc5f781d6636a0b15d040f9cffb1d46cd11079aa40a26b662217f48
SHA51290d2cbd882ff8043412ad25e74df0cf6b71d6f3fbdfa6f1efa0efc8eed86a925606c7d2e967f112a34d3f0e04f01a396898508571400dcf7e6fd69e78f406638
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
276KB
MD59f14aa0555e80190fe99817d0b3ae058
SHA1d5b77274a0d5cb8a3b17d12b26e8fb48914c6d98
SHA256c1130543ef2f5093477fc0f719d889445cbddf096494122a64f268aeb9a2d783
SHA51288ea107c23eb017d8dae25d57402a11ccc2660d4860259f40820676aebeef1df920e25d1280eeca5cc24a249d8f654211c752c7ed64399f5d07ef160c6c238e7