Overview
overview
10Static
static
10Dropper/Berbew.exe
windows10-1703-x64
10Dropper/Berbew.exe
windows10-2004-x64
10Dropper/Phorphiex.exe
windows10-1703-x64
10Dropper/Phorphiex.exe
windows10-2004-x64
10RAT/31.exe
windows10-1703-x64
10RAT/31.exe
windows10-2004-x64
10RAT/XClient.exe
windows10-1703-x64
10RAT/XClient.exe
windows10-2004-x64
10RAT/file.exe
windows10-1703-x64
7RAT/file.exe
windows10-2004-x64
7Ransomware...-2.exe
windows10-1703-x64
10Ransomware...-2.exe
windows10-2004-x64
10Ransomware...01.exe
windows10-1703-x64
10Ransomware...01.exe
windows10-2004-x64
10Ransomware...lt.exe
windows10-1703-x64
10Ransomware...lt.exe
windows10-2004-x64
10Stealers/Azorult.exe
windows10-1703-x64
10Stealers/Azorult.exe
windows10-2004-x64
10Stealers/B...on.exe
windows10-1703-x64
10Stealers/B...on.exe
windows10-2004-x64
10Stealers/Dridex.dll
windows10-1703-x64
10Stealers/Dridex.dll
windows10-2004-x64
10Stealers/M..._2.exe
windows10-1703-x64
10Stealers/M..._2.exe
windows10-2004-x64
10Stealers/lumma.exe
windows10-1703-x64
10Stealers/lumma.exe
windows10-2004-x64
10Trojan/BetaBot.exe
windows10-1703-x64
10Trojan/BetaBot.exe
windows10-2004-x64
10Trojan/Smo...er.exe
windows10-1703-x64
10Trojan/Smo...er.exe
windows10-2004-x64
10Resubmissions
23/03/2026, 02:00
260323-cffqcsds9n1005/03/2026, 16:32
260305-t1xm2scx3k1011/02/2026, 21:18
260211-z5q9qaav8h1011/05/2025, 03:54
250511-egp2javwat1003/09/2024, 14:02
240903-rb57sazdqf1003/09/2024, 13:51
240903-q59avszclf1002/09/2024, 19:51
240902-yk8gtsxbpd1002/09/2024, 02:27
240902-cxh7tazflg1002/09/2024, 02:26
240902-cwxc2sygll1021/06/2024, 19:37
240621-yca7cszgnd10Analysis
- max time kernel
149s - max time network
151s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system - submitted
09/06/2024, 17:07
Behavioral task
behavioral1
Sample
Dropper/Berbew.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral2
Sample
Dropper/Berbew.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Dropper/Phorphiex.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral4
Sample
Dropper/Phorphiex.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
RAT/31.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral6
Sample
RAT/31.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
RAT/XClient.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral8
Sample
RAT/XClient.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
RAT/file.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral10
Sample
RAT/file.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Ransomware/Client-2.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral12
Sample
Ransomware/Client-2.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Ransomware/criticalupdate01.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral14
Sample
Ransomware/criticalupdate01.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Ransomware/default.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral16
Sample
Ransomware/default.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Stealers/Azorult.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral18
Sample
Stealers/Azorult.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Stealers/BlackMoon.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral20
Sample
Stealers/BlackMoon.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Stealers/Dridex.dll
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral22
Sample
Stealers/Dridex.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral24
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Stealers/lumma.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral26
Sample
Stealers/lumma.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Trojan/BetaBot.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral28
Sample
Trojan/BetaBot.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Trojan/SmokeLoader.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral30
Sample
Trojan/SmokeLoader.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
General
- Target RAT/XClient.exe
- Size 172KB
- Sample240609-vm7rjadd73
- SHA256 75a8719e83e4aecbe51287d7bfaf1e334fa190c7784324f24bcf61ab984de20a
- MD5 75ba783757c5b61bd841afa136fc3eda
- SHA1 8db9cda9508471a23f9b743027fa115e01bc1fe1
- SHA512 9a6cfbf4302336662527837bf60b30b458f8d438bd6e9563093d4948bf81c79d56578e965d836e90aafde553d1cdc9c6df81a254aafcfb3379fbe6405dce0ea1
- SSDEEP 1536:vJcr5kCyoAp30kaF6CiJzt7UbjFdZe8e6TOAJkU7JsOpysa7iAMI:BcmNNxda6zZUbjHZe8jO6H2OpYuAf
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
-
xworm
-
Install_directory
%AppData%
-
install_file
XClient.exe
-
pastebin_url
https://pastebin.com/raw/2jTT3Lnj
Signatures
- Detect Xworm Payload 1 IoCs
resource yara_rule behavioral7/memory/5052-0-0x0000000000850000-0x0000000000880000-memory.dmp family_xworm - Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3024 powershell.exe 1788 powershell.exe 4460 powershell.exe 2760 powershell.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk XClient.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk XClient.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe" XClient.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
flow ioc 41 7.tcp.eu.ngrok.io 4 pastebin.com 5 pastebin.com 7 7.tcp.eu.ngrok.io 20 7.tcp.eu.ngrok.io - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 3024 powershell.exe 3024 powershell.exe 3024 powershell.exe 1788 powershell.exe 1788 powershell.exe 1788 powershell.exe 4460 powershell.exe 4460 powershell.exe 4460 powershell.exe 2760 powershell.exe 2760 powershell.exe 2760 powershell.exe 5052 XClient.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5052 XClient.exe Token: SeDebugPrivilege 3024 powershell.exe Token: SeIncreaseQuotaPrivilege 3024 powershell.exe Token: SeSecurityPrivilege 3024 powershell.exe Token: SeTakeOwnershipPrivilege 3024 powershell.exe Token: SeLoadDriverPrivilege 3024 powershell.exe Token: SeSystemProfilePrivilege 3024 powershell.exe Token: SeSystemtimePrivilege 3024 powershell.exe Token: SeProfSingleProcessPrivilege 3024 powershell.exe Token: SeIncBasePriorityPrivilege 3024 powershell.exe Token: SeCreatePagefilePrivilege 3024 powershell.exe Token: SeBackupPrivilege 3024 powershell.exe Token: SeRestorePrivilege 3024 powershell.exe Token: SeShutdownPrivilege 3024 powershell.exe Token: SeDebugPrivilege 3024 powershell.exe Token: SeSystemEnvironmentPrivilege 3024 powershell.exe Token: SeRemoteShutdownPrivilege 3024 powershell.exe Token: SeUndockPrivilege 3024 powershell.exe Token: SeManageVolumePrivilege 3024 powershell.exe Token: 33 3024 powershell.exe Token: 34 3024 powershell.exe Token: 35 3024 powershell.exe Token: 36 3024 powershell.exe Token: SeDebugPrivilege 1788 powershell.exe Token: SeIncreaseQuotaPrivilege 1788 powershell.exe Token: SeSecurityPrivilege 1788 powershell.exe Token: SeTakeOwnershipPrivilege 1788 powershell.exe Token: SeLoadDriverPrivilege 1788 powershell.exe Token: SeSystemProfilePrivilege 1788 powershell.exe Token: SeSystemtimePrivilege 1788 powershell.exe Token: SeProfSingleProcessPrivilege 1788 powershell.exe Token: SeIncBasePriorityPrivilege 1788 powershell.exe Token: SeCreatePagefilePrivilege 1788 powershell.exe Token: SeBackupPrivilege 1788 powershell.exe Token: SeRestorePrivilege 1788 powershell.exe Token: SeShutdownPrivilege 1788 powershell.exe Token: SeDebugPrivilege 1788 powershell.exe Token: SeSystemEnvironmentPrivilege 1788 powershell.exe Token: SeRemoteShutdownPrivilege 1788 powershell.exe Token: SeUndockPrivilege 1788 powershell.exe Token: SeManageVolumePrivilege 1788 powershell.exe Token: 33 1788 powershell.exe Token: 34 1788 powershell.exe Token: 35 1788 powershell.exe Token: 36 1788 powershell.exe Token: SeDebugPrivilege 4460 powershell.exe Token: SeIncreaseQuotaPrivilege 4460 powershell.exe Token: SeSecurityPrivilege 4460 powershell.exe Token: SeTakeOwnershipPrivilege 4460 powershell.exe Token: SeLoadDriverPrivilege 4460 powershell.exe Token: SeSystemProfilePrivilege 4460 powershell.exe Token: SeSystemtimePrivilege 4460 powershell.exe Token: SeProfSingleProcessPrivilege 4460 powershell.exe Token: SeIncBasePriorityPrivilege 4460 powershell.exe Token: SeCreatePagefilePrivilege 4460 powershell.exe Token: SeBackupPrivilege 4460 powershell.exe Token: SeRestorePrivilege 4460 powershell.exe Token: SeShutdownPrivilege 4460 powershell.exe Token: SeDebugPrivilege 4460 powershell.exe Token: SeSystemEnvironmentPrivilege 4460 powershell.exe Token: SeRemoteShutdownPrivilege 4460 powershell.exe Token: SeUndockPrivilege 4460 powershell.exe Token: SeManageVolumePrivilege 4460 powershell.exe Token: 33 4460 powershell.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5052 XClient.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 5052 wrote to memory of 3024 5052 XClient.exe 73 PID 5052 wrote to memory of 3024 5052 XClient.exe 73 PID 5052 wrote to memory of 1788 5052 XClient.exe 76 PID 5052 wrote to memory of 1788 5052 XClient.exe 76 PID 5052 wrote to memory of 4460 5052 XClient.exe 78 PID 5052 wrote to memory of 4460 5052 XClient.exe 78 PID 5052 wrote to memory of 2760 5052 XClient.exe 80 PID 5052 wrote to memory of 2760 5052 XClient.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\RAT\XClient.exe"C:\Users\Admin\AppData\Local\Temp\RAT\XClient.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RAT\XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3024
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1788
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4460
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2760
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 3KB
- SHA256 c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033
- MD5 ad5cd538ca58cb28ede39c108acb5785
- SHA1 1ae910026f3dbe90ed025e9e96ead2b5399be877
- SHA512 c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 cf78729fbf60f9c2a9448af33022422eb241149f822a8e9b482a2daf48b23aa3
- MD5 c479b836b1f6e175a2b3ebb2493023be
- SHA1 d89063add83b7ed1067b76048ca77073400c3734
- SHA512 f2d8bc2804eecc2f73b6b3dcefbfc1ba349068650f4eba758013e71fa4f38070989368c1a1132ba344ed1ee9767f4dd69d59c498ef019166fa82d8b67d935d51
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 7788aceab7325c7eaeb0c7c6ef1def257f8ffe731874f9b9d3247590528b6011
- MD5 d26e61b05e1a82bc1ed5078b6f020fbb
- SHA1 5a7b374a664e5975e3aacab00e30fb499bbc5dd8
- SHA512 75bfdbfc5e79404951e82448f68cb14b70091ba5abf4119029c826b403ca30d0612d3ab8cdb8190f1c8269ccd5cea27e17736b123990c96557d1cbb61f1a5f1c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 4c76cad7e8040f33abe807e1c5072bcb1f187bdfa997b9b73737ceafaeb97d36
- MD5 9d3067fc9b8c5bd2c447abcb65069144
- SHA1 ad5f4e09c9956c522db94a05453e997527cbb9ba
- SHA512 59463fb53f2f626863b4c003a2a820201ff13c13aa4353397a43c36aceebe2e0d615171ecc6f4e9ad9d9e027675bfe06aca8429abdf1fb2efc19c1279877e620
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q24u0x33.key.ps1
- Size 1B
- SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
- MD5 c4ca4238a0b923820dcc509a6f75849b
- SHA1 356a192b7913b04c54574d18c28d46e6395428ab
- SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
- MD5 SHA1 SHA512