Overview
overview
10Static
static
10XClient.exe
windows10-1703-x64
XClient.exe
windows7-x64
XClient.exe
windows10-1703-x64
XClient.exe
windows10-2004-x64
XClient.exe
windows11-21h2-x64
XClient.exe
android-10-x64
XClient.exe
android-10-x64
XClient.exe
android-11-x64
XClient.exe
android-13-x64
XClient.exe
android-9-x86
XClient.exe
macos-10.15-amd64
4XClient.exe
macos-10.15-amd64
1XClient.exe
ubuntu-22.04-amd64
XClient.exe
debian-12-armhf
XClient.exe
debian-12-mipsel
XClient.exe
debian-9-armhf
XClient.exe
debian-9-mips
XClient.exe
debian-9-mipsel
XClient.exe
ubuntu-18.04-amd64
XClient.exe
ubuntu-20.04-amd64
XClient.exe
ubuntu-22.04-amd64
XClient.exe
ubuntu-24.04-amd64
Analysis
-
max time kernel
44s -
max time network
44s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
01-08-2024 20:43
Behavioral task
behavioral1
Sample
XClient.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
XClient.exe
Resource
win7-20240729-en
Behavioral task
behavioral3
Sample
XClient.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
XClient.exe
Resource
win10v2004-20240730-en
Behavioral task
behavioral5
Sample
XClient.exe
Resource
win11-20240730-en
Behavioral task
behavioral6
Sample
XClient.exe
Resource
android-x64-20240624-en
Behavioral task
behavioral7
Sample
XClient.exe
Resource
android-x64-20240624-en
Behavioral task
behavioral8
Sample
XClient.exe
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral9
Sample
XClient.exe
Resource
android-33-x64-arm64-20240624-en
Behavioral task
behavioral10
Sample
XClient.exe
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral11
Sample
XClient.exe
Resource
macos-20240711.1-en
Behavioral task
behavioral12
Sample
XClient.exe
Resource
macos-20240711.1-en
Behavioral task
behavioral13
Sample
XClient.exe
Resource
ubuntu2204-amd64-20240522.1-en
Behavioral task
behavioral14
Sample
XClient.exe
Resource
debian12-armhf-20240221-en
Behavioral task
behavioral15
Sample
XClient.exe
Resource
debian12-mipsel-20240729-en
Behavioral task
behavioral16
Sample
XClient.exe
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral17
Sample
XClient.exe
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral18
Sample
XClient.exe
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral19
Sample
XClient.exe
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral20
Sample
XClient.exe
Resource
ubuntu2004-amd64-20240611-en
Behavioral task
behavioral21
Sample
XClient.exe
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral22
Sample
XClient.exe
Resource
ubuntu2404-amd64-20240729-en
Errors
General
-
Target
XClient.exe
-
Size
80KB
-
MD5
bfa950b37b6a4f8de71af861e677a8b4
-
SHA1
2ee40bfbf2964d92c82256e5924169295dfdd225
-
SHA256
07f94f8f6061ba95899914496edc5854aa810de56797d9004875276d60e21ade
-
SHA512
235b514fac01b24edaef3aeb4209676789b6ba9264a8798cb7ae48c26d2455cdd8f254e92bbba688535acb69fd77b3c0a0a549cf97ece84c235cc74f72234e1a
-
SSDEEP
1536:EI5NuEGJkEtydWqZQSp1eS+b59gxzhfxdl/5m6qeo//3Oy/4IK4Dax5:Eg1GhtktQGAS+b59cJ4eA/OlINDab
Malware Config
Extracted
xworm
full-self.gl.at.ply.gg:45212
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral4/memory/3548-0-0x0000000000D60000-0x0000000000D7A000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2888 powershell.exe 4992 powershell.exe 3700 powershell.exe 4340 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1266786182-1874524688-71015548-1000\Control Panel\International\Geo\Nation XClient.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1266786182-1874524688-71015548-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe" XClient.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "154" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 4992 powershell.exe 4992 powershell.exe 3700 powershell.exe 3700 powershell.exe 4340 powershell.exe 4340 powershell.exe 2888 powershell.exe 2888 powershell.exe 3548 XClient.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 3548 XClient.exe Token: SeDebugPrivilege 4992 powershell.exe Token: SeDebugPrivilege 3700 powershell.exe Token: SeDebugPrivilege 4340 powershell.exe Token: SeDebugPrivilege 2888 powershell.exe Token: SeDebugPrivilege 3548 XClient.exe Token: SeShutdownPrivilege 3868 shutdown.exe Token: SeRemoteShutdownPrivilege 3868 shutdown.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3548 XClient.exe 4396 LogonUI.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3548 wrote to memory of 4992 3548 XClient.exe 86 PID 3548 wrote to memory of 4992 3548 XClient.exe 86 PID 3548 wrote to memory of 3700 3548 XClient.exe 88 PID 3548 wrote to memory of 3700 3548 XClient.exe 88 PID 3548 wrote to memory of 4340 3548 XClient.exe 90 PID 3548 wrote to memory of 4340 3548 XClient.exe 90 PID 3548 wrote to memory of 2888 3548 XClient.exe 92 PID 3548 wrote to memory of 2888 3548 XClient.exe 92 PID 3548 wrote to memory of 3868 3548 XClient.exe 97 PID 3548 wrote to memory of 3868 3548 XClient.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4992
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3700
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4340
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2888
-
-
C:\Windows\SYSTEM32\shutdown.exeshutdown.exe /f /s /t 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:3868
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa394a055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4396
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD56d42b6da621e8df5674e26b799c8e2aa
SHA1ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA2565ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA51253faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29
-
Filesize
944B
MD5a7cc007980e419d553568a106210549a
SHA1c03099706b75071f36c3962fcc60a22f197711e0
SHA256a5735921fc72189c8bf577f3911486cf031708dc8d6bc764fe3e593c0a053165
SHA512b9aaf29403c467daef80a1ae87478afc33b78f4e1ca16189557011bb83cf9b3e29a0f85c69fa209c45201fb28baca47d31756eee07b79c6312c506e8370f7666
-
Filesize
944B
MD534f595487e6bfd1d11c7de88ee50356a
SHA14caad088c15766cc0fa1f42009260e9a02f953bb
SHA2560f9a4b52e01cb051052228a55d0515911b7ef5a8db3cf925528c746df511424d
SHA51210976c5deaf9fac449e703e852c3b08d099f430de2d7c7b8e2525c35d63e28b890e5aab63feff9b20bca0aaf9f35a3ba411aee3fbeee9ea59f90ed25bd617a0b
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82