Malware Analysis Report

2024-11-16 13:40

Sample ID 240601-bg7pssda29
Target 0f2eaea796ec4d932ac2d94c61f6b60d.bin
SHA256 3cbd0ee7be00d113b442a80e6f9a44dae3ef5aa66da36a42a36b994ef82a7735
Tags
xworm execution rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3cbd0ee7be00d113b442a80e6f9a44dae3ef5aa66da36a42a36b994ef82a7735

Threat Level: Known bad

The file 0f2eaea796ec4d932ac2d94c61f6b60d.bin was found to be: Known bad.

Malicious Activity Summary

xworm execution rat trojan

Xworm

Detect Xworm Payload

Command and Scripting Interpreter: PowerShell

Drops startup file

Checks computer location settings

Loads dropped DLL

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-01 01:08

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-01 01:08

Reported

2024-06-01 01:10

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5076 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe
PID 5076 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe
PID 5076 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe
PID 5076 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe
PID 5076 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe
PID 5076 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe
PID 5076 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe
PID 5076 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe
PID 1140 wrote to memory of 3992 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1140 wrote to memory of 3992 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1140 wrote to memory of 3992 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1140 wrote to memory of 4100 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1140 wrote to memory of 4100 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1140 wrote to memory of 4100 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1140 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1140 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1140 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1140 wrote to memory of 1288 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1140 wrote to memory of 1288 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1140 wrote to memory of 1288 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe

"C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe"

C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe

"C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
DE 104.250.180.178:7061 tcp
US 8.8.8.8:53 178.180.250.104.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 2.36.159.162.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 145.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 105.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/5076-0-0x0000000074CEE000-0x0000000074CEF000-memory.dmp

memory/5076-1-0x0000000000E90000-0x0000000000F12000-memory.dmp

memory/5076-2-0x0000000005F30000-0x00000000064D4000-memory.dmp

memory/5076-3-0x0000000005980000-0x0000000005A12000-memory.dmp

memory/5076-4-0x0000000005910000-0x000000000591A000-memory.dmp

memory/5076-6-0x0000000074CE0000-0x0000000075490000-memory.dmp

memory/5076-5-0x0000000005C10000-0x0000000005CAC000-memory.dmp

memory/5076-7-0x0000000008360000-0x0000000008378000-memory.dmp

memory/5076-8-0x0000000006BE0000-0x0000000006BF0000-memory.dmp

memory/5076-9-0x0000000006E10000-0x0000000006E66000-memory.dmp

memory/1140-10-0x0000000000400000-0x0000000000414000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe.log

MD5 8ec831f3e3a3f77e4a7b9cd32b48384c
SHA1 d83f09fd87c5bd86e045873c231c14836e76a05c
SHA256 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA512 26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

memory/1140-13-0x0000000074CE0000-0x0000000075490000-memory.dmp

memory/5076-14-0x0000000074CE0000-0x0000000075490000-memory.dmp

memory/3992-15-0x0000000004960000-0x0000000004996000-memory.dmp

memory/3992-16-0x0000000074CE0000-0x0000000075490000-memory.dmp

memory/3992-17-0x0000000004FF0000-0x0000000005618000-memory.dmp

memory/3992-18-0x0000000074CE0000-0x0000000075490000-memory.dmp

memory/3992-19-0x0000000004F30000-0x0000000004F52000-memory.dmp

memory/3992-20-0x0000000005720000-0x0000000005786000-memory.dmp

memory/3992-21-0x0000000005790000-0x00000000057F6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zo4lsbt1.pd3.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3992-31-0x00000000058D0000-0x0000000005C24000-memory.dmp

memory/3992-32-0x0000000005F10000-0x0000000005F2E000-memory.dmp

memory/3992-33-0x0000000005F50000-0x0000000005F9C000-memory.dmp

memory/3992-34-0x00000000064F0000-0x0000000006522000-memory.dmp

memory/3992-35-0x0000000070F50000-0x0000000070F9C000-memory.dmp

memory/3992-45-0x00000000070F0000-0x000000000710E000-memory.dmp

memory/3992-46-0x0000000007110000-0x00000000071B3000-memory.dmp

memory/3992-47-0x0000000007890000-0x0000000007F0A000-memory.dmp

memory/3992-48-0x0000000007240000-0x000000000725A000-memory.dmp

memory/3992-49-0x00000000072B0000-0x00000000072BA000-memory.dmp

memory/3992-50-0x00000000074C0000-0x0000000007556000-memory.dmp

memory/3992-51-0x0000000007440000-0x0000000007451000-memory.dmp

memory/3992-52-0x0000000007470000-0x000000000747E000-memory.dmp

memory/3992-53-0x0000000007480000-0x0000000007494000-memory.dmp

memory/3992-54-0x0000000007580000-0x000000000759A000-memory.dmp

memory/3992-55-0x0000000007560000-0x0000000007568000-memory.dmp

memory/3992-58-0x0000000074CE0000-0x0000000075490000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 ad6d24d288df976a82cde4c3e10ebe5c
SHA1 b0902386871f85192dcf13c10acbd35259a823ef
SHA256 84a58ec01e5f75175d28c7244e94a65fd758c9db1b9eb7f707a7f7b0e8fe27f9
SHA512 c439fd3494f675befa35f1c9a5c6a01e8b6ad1323afee2afbee40bf76e44f8f7445a7cc39ab741ea1f06b862ba7e2d13bd894d1ebc40dcec50c5e6c1bad5702d

memory/4100-70-0x0000000070F50000-0x0000000070F9C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 e63c0c580ebbc560e1923220ee0295a1
SHA1 52acbfd50ee5196f99a6c344723b5ba9ada7c8ff
SHA256 0666e66f35ba3d2d11e2e7e7a78c27a28405a726406af406ebb9b84ed372da49
SHA512 ef8d8012b199548fc3310eaf4f7388715cda1766b1bcd507280f2b26595235f67612df324179d5fceefdc5878fbbadbd71d45045f940cc76fc397d5869f3a911

memory/1264-91-0x0000000070F50000-0x0000000070F9C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 4b70dd9d6e19e396fae20dcb51d97dd1
SHA1 58a0fa350a346e31527a3c8971e356d273ccdac7
SHA256 ca682e8539056d7db89bd885e09480fcc8ad959568d5b454e41b350372498e5e
SHA512 447bdfb888ee4cb6f93fd6c44dd756e62f31bc23e52164a63c817b7b7b75fa70784031c04ac452fa975a256307799b91120ec274bf8d8ff9fe456835b877dc3f

memory/1288-112-0x0000000070F50000-0x0000000070F9C000-memory.dmp

memory/1140-127-0x0000000074CE0000-0x0000000075490000-memory.dmp

memory/1140-128-0x0000000074CE0000-0x0000000075490000-memory.dmp

memory/1140-129-0x0000000074CE0000-0x0000000075490000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-01 01:08

Reported

2024-06-01 01:10

Platform

win7-20240508-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2036 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe
PID 2036 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe
PID 2036 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe
PID 2036 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe
PID 2036 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe
PID 2036 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe
PID 2036 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe
PID 2036 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe
PID 2036 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe
PID 2928 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2928 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe

"C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe"

C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe

"C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'

Network

Country Destination Domain Proto
DE 104.250.180.178:7061 tcp

Files

memory/2036-0-0x000000007488E000-0x000000007488F000-memory.dmp

memory/2036-1-0x0000000000BA0000-0x0000000000C22000-memory.dmp

memory/2036-2-0x0000000074880000-0x0000000074F6E000-memory.dmp

memory/2036-3-0x00000000005A0000-0x00000000005B8000-memory.dmp

memory/2036-4-0x0000000000290000-0x00000000002A0000-memory.dmp

memory/2036-5-0x0000000004F20000-0x0000000004F76000-memory.dmp

memory/2928-16-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2928-9-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2928-7-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2928-8-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2928-6-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2928-14-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2928-12-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2928-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2928-17-0x0000000074880000-0x0000000074F6E000-memory.dmp

memory/2036-18-0x0000000074880000-0x0000000074F6E000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 9dda11e87f34e85b59a4f79c1eb96346
SHA1 78cc63560e5bfc7e94b9a1bee3c7b5f5915952ef
SHA256 3d041d95a56d2a7d6df22ac3e51570e555861b82798f462d9fa1b8d4efbf6a55
SHA512 c07ded8dd4f5e5172749cadd4527e257f93da227c2498d7ceaffb53bcb5df3657d30c45af1f1be598ac20324d1ba421384b9890ecda9b704e42aa2dc1271ceb9

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

\Users\Admin\AppData\Roaming\XClient.exe

MD5 0f2eaea796ec4d932ac2d94c61f6b60d
SHA1 bd5f3e5043afebcc1c08e763ab8afc0183f5b7f7
SHA256 e879f3a1cc7733303f6edebd710066dd418d78dbbc1a1393b50d4fc3d1d74b51
SHA512 addee2ef8b337d2241da0a4fd02e378365e5bb998b1e7603821a91723cc0a4d7c3dee99ba2f016df227d2a5c84ef1939aa4a72dbfc595b788195cdc2025bf69c

memory/2928-42-0x0000000074880000-0x0000000074F6E000-memory.dmp

memory/2928-43-0x0000000074880000-0x0000000074F6E000-memory.dmp

memory/2928-44-0x0000000074880000-0x0000000074F6E000-memory.dmp