Analysis
- max time kernel
149s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
06/06/2024, 07:19
General
- Target DRAFT - YML Draft BL I209493748, SO Y171 - YM CENTENNIAL V.045S.scr.exe
- Size 541KB
- Sample240606-h5jffacb38
- SHA256 ca8b01154f69d84a04afd66dab43bf9a7ace3c5d097d64ff401045fb6cc65dbb
Malware Config
Extracted
-
xworm
-
104.250.180.178:7061
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 15 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DRAFT - YML Draft BL I209493748, SO Y171 - YM CENTENNIAL V.045S.scr.exe"C:\Users\Admin\AppData\Local\Temp\DRAFT - YML Draft BL I209493748, SO Y171 - YM CENTENNIAL V.045S.scr.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DRAFT - YML Draft BL I209493748, SO Y171 - YM CENTENNIAL V.045S.scr.exe"C:\Users\Admin\AppData\Local\Temp\DRAFT - YML Draft BL I209493748, SO Y171 - YM CENTENNIAL V.045S.scr.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DRAFT - YML Draft BL I209493748, SO Y171 - YM CENTENNIAL V.045S.scr.exe"C:\Users\Admin\AppData\Local\Temp\DRAFT - YML Draft BL I209493748, SO Y171 - YM CENTENNIAL V.045S.scr.exe"2⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\DRAFT - YML Draft BL I209493748, SO Y171 - YM CENTENNIAL V.045S.scr.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'DRAFT - YML Draft BL I209493748, SO Y171 - YM CENTENNIAL V.045S.scr.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2268 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
DRAFT - YML Draft BL I209493748, SO Y171 - YM CENTENNIAL V.045S.scr.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_yrgt1mpk.edn.ps1
memory/384-94-0x0000000005A00000-0x0000000005D54000-memory.dmp
memory/384-96-0x000000006FF60000-0x000000006FFAC000-memory.dmp
memory/1836-10-0x000000000A500000-0x000000000A59C000-memory.dmp
memory/1836-9-0x0000000007CE0000-0x0000000007D36000-memory.dmp
memory/1836-7-0x00000000055E0000-0x00000000055EE000-memory.dmp
memory/1836-8-0x0000000007CC0000-0x0000000007CD0000-memory.dmp
memory/1836-14-0x000000007491E000-0x000000007491F000-memory.dmp
memory/1836-6-0x00000000055C0000-0x00000000055D6000-memory.dmp
memory/1836-5-0x0000000005050000-0x000000000505A000-memory.dmp
memory/1836-16-0x0000000074910000-0x00000000750C0000-memory.dmp
memory/1836-4-0x0000000074910000-0x00000000750C0000-memory.dmp
memory/1836-3-0x0000000004F90000-0x0000000005022000-memory.dmp
memory/1836-2-0x00000000055F0000-0x0000000005B94000-memory.dmp
memory/1836-1-0x0000000000520000-0x00000000005AE000-memory.dmp
memory/1836-0-0x000000007491E000-0x000000007491F000-memory.dmp
memory/2904-35-0x00000000068F0000-0x000000000690E000-memory.dmp
memory/2904-54-0x0000000007E00000-0x0000000007E11000-memory.dmp
memory/2904-24-0x0000000006270000-0x00000000062D6000-memory.dmp
memory/2904-22-0x0000000005880000-0x00000000058A2000-memory.dmp
memory/2904-34-0x00000000063E0000-0x0000000006734000-memory.dmp
memory/2904-21-0x0000000005A60000-0x0000000006088000-memory.dmp
memory/2904-36-0x00000000069A0000-0x00000000069EC000-memory.dmp
memory/2904-38-0x000000006FF60000-0x000000006FFAC000-memory.dmp
memory/2904-37-0x0000000006EC0000-0x0000000006EF2000-memory.dmp
memory/2904-48-0x0000000006EA0000-0x0000000006EBE000-memory.dmp
memory/2904-49-0x0000000006F10000-0x0000000006FB3000-memory.dmp
memory/2904-50-0x0000000008240000-0x00000000088BA000-memory.dmp
memory/2904-51-0x0000000007C00000-0x0000000007C1A000-memory.dmp
memory/2904-52-0x0000000007C70000-0x0000000007C7A000-memory.dmp
memory/2904-53-0x0000000007E80000-0x0000000007F16000-memory.dmp
memory/2904-23-0x0000000006200000-0x0000000006266000-memory.dmp
memory/2904-17-0x0000000002FB0000-0x0000000002FE6000-memory.dmp
memory/2904-56-0x0000000007E50000-0x0000000007E5E000-memory.dmp
memory/2904-57-0x0000000007E60000-0x0000000007E74000-memory.dmp
memory/2904-58-0x0000000007F60000-0x0000000007F7A000-memory.dmp
memory/2904-59-0x0000000007F40000-0x0000000007F48000-memory.dmp
memory/2904-62-0x0000000074910000-0x00000000750C0000-memory.dmp
memory/2904-20-0x0000000074910000-0x00000000750C0000-memory.dmp
memory/2904-19-0x0000000074910000-0x00000000750C0000-memory.dmp
memory/2904-18-0x0000000074910000-0x00000000750C0000-memory.dmp
memory/3016-117-0x000000006FF60000-0x000000006FFAC000-memory.dmp
memory/3196-74-0x000000006FF60000-0x000000006FFAC000-memory.dmp
memory/3420-55-0x0000000074910000-0x00000000750C0000-memory.dmp
memory/3420-15-0x0000000074910000-0x00000000750C0000-memory.dmp
memory/3420-11-0x0000000000400000-0x0000000000414000-memory.dmp
memory/3420-132-0x0000000074910000-0x00000000750C0000-memory.dmp
memory/3420-133-0x0000000074910000-0x00000000750C0000-memory.dmp