Analysis
-
max time kernel
129s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-06-2024 01:19
Static task
static1
Behavioral task
behavioral1
Sample
7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe
Resource
win7-20240508-en
General
-
Target
7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe
-
Size
548KB
-
MD5
41dc167b623d1e1d03a4eff1763774ad
-
SHA1
c3b4c41bd9069acaff2816ddc6a99988c9eefea8
-
SHA256
7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef
-
SHA512
4aa6f5d3991fd6e98f1df2317fcb9d4e66b43b820c023f83d721d57550ece27403f2612cf23804baeccd3a67f76ad46838c46fa2e3910d6c7f73f2b5de6d07f8
-
SSDEEP
12288:04L+hETMUnJEz70ABnr9vQ0nqSbBZF70hiolTm+k:3lEz70YWKB8Pl
Malware Config
Extracted
xworm
104.250.180.178:5414
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2988-9-0x0000000000400000-0x0000000000416000-memory.dmp family_xworm behavioral1/memory/2988-13-0x0000000000400000-0x0000000000416000-memory.dmp family_xworm behavioral1/memory/2988-10-0x0000000000400000-0x0000000000416000-memory.dmp family_xworm behavioral1/memory/2988-15-0x0000000000400000-0x0000000000416000-memory.dmp family_xworm behavioral1/memory/2988-17-0x0000000000400000-0x0000000000416000-memory.dmp family_xworm -
Detects Windows executables referencing non-Windows User-Agents 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2988-9-0x0000000000400000-0x0000000000416000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2988-13-0x0000000000400000-0x0000000000416000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2988-10-0x0000000000400000-0x0000000000416000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2988-15-0x0000000000400000-0x0000000000416000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2988-17-0x0000000000400000-0x0000000000416000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Detects executables packed with SmartAssembly 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2416-5-0x00000000004A0000-0x00000000004AC000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 2684 powershell.exe 3024 powershell.exe 2632 powershell.exe 2688 powershell.exe -
Drops startup file 2 IoCs
Processes:
7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe -
Loads dropped DLL 1 IoCs
Processes:
7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exepid process 2988 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exedescription pid process target process PID 2416 set thread context of 2988 2416 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exepowershell.exepowershell.exepowershell.exepowershell.exe7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exepid process 2416 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe 3024 powershell.exe 2632 powershell.exe 2688 powershell.exe 2684 powershell.exe 2988 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2416 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe Token: SeDebugPrivilege 2988 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe Token: SeDebugPrivilege 3024 powershell.exe Token: SeDebugPrivilege 2632 powershell.exe Token: SeDebugPrivilege 2688 powershell.exe Token: SeDebugPrivilege 2684 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exepid process 2988 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exedescription pid process target process PID 2416 wrote to memory of 3004 2416 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe PID 2416 wrote to memory of 3004 2416 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe PID 2416 wrote to memory of 3004 2416 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe PID 2416 wrote to memory of 3004 2416 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe PID 2416 wrote to memory of 2988 2416 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe PID 2416 wrote to memory of 2988 2416 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe PID 2416 wrote to memory of 2988 2416 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe PID 2416 wrote to memory of 2988 2416 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe PID 2416 wrote to memory of 2988 2416 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe PID 2416 wrote to memory of 2988 2416 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe PID 2416 wrote to memory of 2988 2416 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe PID 2416 wrote to memory of 2988 2416 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe PID 2416 wrote to memory of 2988 2416 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe PID 2988 wrote to memory of 3024 2988 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe powershell.exe PID 2988 wrote to memory of 3024 2988 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe powershell.exe PID 2988 wrote to memory of 3024 2988 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe powershell.exe PID 2988 wrote to memory of 3024 2988 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe powershell.exe PID 2988 wrote to memory of 2632 2988 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe powershell.exe PID 2988 wrote to memory of 2632 2988 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe powershell.exe PID 2988 wrote to memory of 2632 2988 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe powershell.exe PID 2988 wrote to memory of 2632 2988 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe powershell.exe PID 2988 wrote to memory of 2688 2988 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe powershell.exe PID 2988 wrote to memory of 2688 2988 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe powershell.exe PID 2988 wrote to memory of 2688 2988 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe powershell.exe PID 2988 wrote to memory of 2688 2988 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe powershell.exe PID 2988 wrote to memory of 2684 2988 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe powershell.exe PID 2988 wrote to memory of 2684 2988 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe powershell.exe PID 2988 wrote to memory of 2684 2988 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe powershell.exe PID 2988 wrote to memory of 2684 2988 7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe"C:\Users\Admin\AppData\Local\Temp\7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe"C:\Users\Admin\AppData\Local\Temp\7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe"2⤵PID:3004
-
-
C:\Users\Admin\AppData\Local\Temp\7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe"C:\Users\Admin\AppData\Local\Temp\7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe"2⤵
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3024
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '7770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2632
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2688
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD517d7ac19dae5741a99c557c297548723
SHA13362a15c9ed82128aaffa45c31fe56eecaa7bd0c
SHA256a3c35fa227b648f8f02bf2540570aeb258b9c104fdb9388036a33addf20d7891
SHA512baf4eeb01ecc2232461ca2bb2515652aaf582eb3f584ff3d7ee67813cd129e3e05c161b3434874b0ac74b6738653b67a140ad5bfbf825f21a98b9ef7255f9a5e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
548KB
MD541dc167b623d1e1d03a4eff1763774ad
SHA1c3b4c41bd9069acaff2816ddc6a99988c9eefea8
SHA2567770eddde9a0ecf43aaef22995fa8a52dfa074a4f27cf65e38479087bc7138ef
SHA5124aa6f5d3991fd6e98f1df2317fcb9d4e66b43b820c023f83d721d57550ece27403f2612cf23804baeccd3a67f76ad46838c46fa2e3910d6c7f73f2b5de6d07f8