e383276a19a317659873d63010dbf081d7137cd2a2ddc4c06dcf25f12e4b3f7e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

XClient.exe
Size

122KB
Sample

240704-zd59kazema
MD5

8e83fd4fad6074e88b1dac7dbfe848aa
SHA1

e3d607a47d75c40dffe6fcb6510796589f1611f2
SHA256

e383276a19a317659873d63010dbf081d7137cd2a2ddc4c06dcf25f12e4b3f7e
SHA512

1444ff56493ba3e9d1a60881528ec083420c5b54f1fe75fdcada888af424d2ff222a47d56b71a999d5b85733d87bb2de156c7cee627cb49e762610d32701c99e
SSDEEP

3072:Mk+uZlWW1Tbfu/HVcUic0M+p9UpGIgE5nuPMuuHbQb0d/:om74HfB0M6UYE5uP2bw6

Score

8^/10

execution persistence

Malware Config

Targets

- Target
  
  XClient.exe
- Size
  
  122KB
- MD5
  
  8e83fd4fad6074e88b1dac7dbfe848aa
- SHA1
  
  e3d607a47d75c40dffe6fcb6510796589f1611f2
- SHA256
  
  e383276a19a317659873d63010dbf081d7137cd2a2ddc4c06dcf25f12e4b3f7e
- SHA512
  
  1444ff56493ba3e9d1a60881528ec083420c5b54f1fe75fdcada888af424d2ff222a47d56b71a999d5b85733d87bb2de156c7cee627cb49e762610d32701c99e
- SSDEEP
  
  3072:Mk+uZlWW1Tbfu/HVcUic0M+p9UpGIgE5nuPMuuHbQb0d/:om74HfB0M6UYE5uP2bw6
Score

8^/10

execution persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

executionpersistence