Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    31-05-2024 09:44

General

  • Target

    e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe

  • Size

    494KB

  • MD5

    0f2eaea796ec4d932ac2d94c61f6b60d

  • SHA1

    bd5f3e5043afebcc1c08e763ab8afc0183f5b7f7

  • SHA256

    e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51

  • SHA512

    addee2ef8b337d2241da0a4fd02e378365e5bb998b1e7603821a91723cc0a4d7c3dee99ba2f016df227d2a5c84ef1939aa4a72dbfc595b788195cdc2025bf69c

  • SSDEEP

    6144:w9BrlrV1JwKcZKGq1uNYCa8Z5gG02jjQFv5jeARhB7KW4x86H+wXCprgT5pbV+f:wbBPJwKcIfoKChzPuj7D+xUprgTn8

Malware Config

Extracted

Family

xworm

C2

104.250.180.178:7061

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Signatures

  • Detect Xworm Payload 5 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops startup file 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe
    "C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1932
    • C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe
      "C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2512
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2552
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2408
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2228
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2588

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    457a0951a623543834513cc873ddd664

    SHA1

    e0ee83d5d68875ed4fce56d53be42e2e9390767d

    SHA256

    841ddebb3f1de18dde0d2a01fc2c1f0ec71dfd53f7ea123eeb61735c69279632

    SHA512

    f810f204b49df007c23839557008f2bfd7404109ac50e807d01e5dbf7e10f4fdcdf181c9c2bb9ed70caed988f0f7baacfbd090361766f4b4b345930430a1f12f

  • \??\PIPE\srvsvc

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • \Users\Admin\AppData\Roaming\XClient.exe

    Filesize

    494KB

    MD5

    0f2eaea796ec4d932ac2d94c61f6b60d

    SHA1

    bd5f3e5043afebcc1c08e763ab8afc0183f5b7f7

    SHA256

    e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51

    SHA512

    addee2ef8b337d2241da0a4fd02e378365e5bb998b1e7603821a91723cc0a4d7c3dee99ba2f016df227d2a5c84ef1939aa4a72dbfc595b788195cdc2025bf69c

  • memory/1932-22-0x0000000074060000-0x000000007474E000-memory.dmp

    Filesize

    6.9MB

  • memory/1932-0-0x000000007406E000-0x000000007406F000-memory.dmp

    Filesize

    4KB

  • memory/1932-5-0x0000000005D00000-0x0000000005D56000-memory.dmp

    Filesize

    344KB

  • memory/1932-1-0x0000000000B10000-0x0000000000B92000-memory.dmp

    Filesize

    520KB

  • memory/1932-2-0x0000000074060000-0x000000007474E000-memory.dmp

    Filesize

    6.9MB

  • memory/1932-4-0x0000000000320000-0x0000000000330000-memory.dmp

    Filesize

    64KB

  • memory/1932-3-0x00000000003E0000-0x00000000003F8000-memory.dmp

    Filesize

    96KB

  • memory/2512-16-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2512-10-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2512-20-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2512-18-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2512-21-0x0000000074060000-0x000000007474E000-memory.dmp

    Filesize

    6.9MB

  • memory/2512-12-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2512-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2512-9-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2512-7-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2512-46-0x0000000074060000-0x000000007474E000-memory.dmp

    Filesize

    6.9MB

  • memory/2512-47-0x0000000074060000-0x000000007474E000-memory.dmp

    Filesize

    6.9MB

  • memory/2512-48-0x0000000074060000-0x000000007474E000-memory.dmp

    Filesize

    6.9MB