Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    31-05-2024 09:55

General

  • Target

    cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe

  • Size

    509KB

  • MD5

    ff3aea929347d0168b02de5d2c2bcec3

  • SHA1

    fd7eaa628f424fc1384bcbd926a551c8e60740db

  • SHA256

    cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651

  • SHA512

    c5ba038472b25fa013852b57fa712a286e56a85f015b68c5e7da72ed403aa0b896deb6583407894ae76dc59e90c475a161504d55202b4b7fe774732b22793c3b

  • SSDEEP

    12288:lUrKkGdrJwKcItNXOMaFshRSxD1ulXrvNE53jHd:DcA9NEQlXTaT

Malware Config

Extracted

Family

xworm

C2

104.250.180.178:7061

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Signatures

  • Detect Xworm Payload 5 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops startup file 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe
    "C:\Users\Admin\AppData\Local\Temp\cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2468
    • C:\Users\Admin\AppData\Local\Temp\cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe
      "C:\Users\Admin\AppData\Local\Temp\cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe"
      2⤵
        PID:2348
      • C:\Users\Admin\AppData\Local\Temp\cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe
        "C:\Users\Admin\AppData\Local\Temp\cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe"
        2⤵
        • Drops startup file
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2040
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2644
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651.exe'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2672
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2512
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2000

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

      Filesize

      7KB

      MD5

      8ca155ba5aac2806de53c05a50ec0bee

      SHA1

      9118de1221c5a4240190f516a1d4c5ca5fe09582

      SHA256

      5c91fb2eaba32941db2888619d60f5501ef4911c49a62d752d3fc74a10ca1d38

      SHA512

      ba8ab5365f58cbff92215ddee837c99c0df2e0cc380417cec5b48a1feca13ad2e227a4309e5ed62bf3f879a7fcb0aea5df9461d770062a2f31dc6fd80c461153

    • \??\PIPE\srvsvc

      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • \Users\Admin\AppData\Roaming\XClient.exe

      Filesize

      509KB

      MD5

      ff3aea929347d0168b02de5d2c2bcec3

      SHA1

      fd7eaa628f424fc1384bcbd926a551c8e60740db

      SHA256

      cdec22b746d955eea4a995cc06795a0964af334d9ad48d9666fa631cf594e651

      SHA512

      c5ba038472b25fa013852b57fa712a286e56a85f015b68c5e7da72ed403aa0b896deb6583407894ae76dc59e90c475a161504d55202b4b7fe774732b22793c3b

    • memory/2040-18-0x0000000073FD0000-0x00000000746BE000-memory.dmp

      Filesize

      6.9MB

    • memory/2040-16-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB

    • memory/2040-44-0x0000000073FD0000-0x00000000746BE000-memory.dmp

      Filesize

      6.9MB

    • memory/2040-8-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB

    • memory/2040-6-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB

    • memory/2040-7-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB

    • memory/2040-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2040-12-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB

    • memory/2040-9-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB

    • memory/2040-43-0x0000000073FD0000-0x00000000746BE000-memory.dmp

      Filesize

      6.9MB

    • memory/2040-14-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB

    • memory/2040-42-0x0000000073FD0000-0x00000000746BE000-memory.dmp

      Filesize

      6.9MB

    • memory/2468-0-0x0000000073FDE000-0x0000000073FDF000-memory.dmp

      Filesize

      4KB

    • memory/2468-3-0x00000000003E0000-0x00000000003F8000-memory.dmp

      Filesize

      96KB

    • memory/2468-2-0x0000000073FD0000-0x00000000746BE000-memory.dmp

      Filesize

      6.9MB

    • memory/2468-1-0x0000000000350000-0x00000000003D4000-memory.dmp

      Filesize

      528KB

    • memory/2468-17-0x0000000073FD0000-0x00000000746BE000-memory.dmp

      Filesize

      6.9MB

    • memory/2468-4-0x0000000000300000-0x0000000000310000-memory.dmp

      Filesize

      64KB

    • memory/2468-5-0x0000000000620000-0x0000000000676000-memory.dmp

      Filesize

      344KB