Overview
overview
10Static
static
10XClient.exe
windows7-x64
10XClient.exe
windows10-1703-x64
10XClient.exe
windows10-2004-x64
10XClient.exe
windows11-21h2-x64
10XClient.exe
macos-10.15-amd64
1XClient.exe
macos-10.15-amd64
4XClient.exe
ubuntu-18.04-amd64
XClient.exe
debian-9-armhf
XClient.exe
debian-9-mips
XClient.exe
debian-9-mipsel
Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
01-08-2024 20:59
Behavioral task
behavioral1
Sample
XClient.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
XClient.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
XClient.exe
Resource
win10v2004-20240730-en
Behavioral task
behavioral4
Sample
XClient.exe
Resource
win11-20240730-en
Behavioral task
behavioral5
Sample
XClient.exe
Resource
macos-20240711.1-en
Behavioral task
behavioral6
Sample
XClient.exe
Resource
macos-20240711.1-en
Behavioral task
behavioral7
Sample
XClient.exe
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral8
Sample
XClient.exe
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral9
Sample
XClient.exe
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral10
Sample
XClient.exe
Resource
debian9-mipsel-20240611-en
General
-
Target
XClient.exe
-
Size
80KB
-
MD5
bfa950b37b6a4f8de71af861e677a8b4
-
SHA1
2ee40bfbf2964d92c82256e5924169295dfdd225
-
SHA256
07f94f8f6061ba95899914496edc5854aa810de56797d9004875276d60e21ade
-
SHA512
235b514fac01b24edaef3aeb4209676789b6ba9264a8798cb7ae48c26d2455cdd8f254e92bbba688535acb69fd77b3c0a0a549cf97ece84c235cc74f72234e1a
-
SSDEEP
1536:EI5NuEGJkEtydWqZQSp1eS+b59gxzhfxdl/5m6qeo//3Oy/4IK4Dax5:Eg1GhtktQGAS+b59cJ4eA/OlINDab
Malware Config
Extracted
xworm
full-self.gl.at.ply.gg:45212
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral2/memory/4144-0-0x0000000000B10000-0x0000000000B2A000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1704 powershell.exe 5056 powershell.exe 2724 powershell.exe 2204 powershell.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe" XClient.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 2724 powershell.exe 2724 powershell.exe 2724 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe 1704 powershell.exe 1704 powershell.exe 1704 powershell.exe 5056 powershell.exe 5056 powershell.exe 5056 powershell.exe 4144 XClient.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4144 XClient.exe Token: SeDebugPrivilege 2724 powershell.exe Token: SeIncreaseQuotaPrivilege 2724 powershell.exe Token: SeSecurityPrivilege 2724 powershell.exe Token: SeTakeOwnershipPrivilege 2724 powershell.exe Token: SeLoadDriverPrivilege 2724 powershell.exe Token: SeSystemProfilePrivilege 2724 powershell.exe Token: SeSystemtimePrivilege 2724 powershell.exe Token: SeProfSingleProcessPrivilege 2724 powershell.exe Token: SeIncBasePriorityPrivilege 2724 powershell.exe Token: SeCreatePagefilePrivilege 2724 powershell.exe Token: SeBackupPrivilege 2724 powershell.exe Token: SeRestorePrivilege 2724 powershell.exe Token: SeShutdownPrivilege 2724 powershell.exe Token: SeDebugPrivilege 2724 powershell.exe Token: SeSystemEnvironmentPrivilege 2724 powershell.exe Token: SeRemoteShutdownPrivilege 2724 powershell.exe Token: SeUndockPrivilege 2724 powershell.exe Token: SeManageVolumePrivilege 2724 powershell.exe Token: 33 2724 powershell.exe Token: 34 2724 powershell.exe Token: 35 2724 powershell.exe Token: 36 2724 powershell.exe Token: SeDebugPrivilege 2204 powershell.exe Token: SeIncreaseQuotaPrivilege 2204 powershell.exe Token: SeSecurityPrivilege 2204 powershell.exe Token: SeTakeOwnershipPrivilege 2204 powershell.exe Token: SeLoadDriverPrivilege 2204 powershell.exe Token: SeSystemProfilePrivilege 2204 powershell.exe Token: SeSystemtimePrivilege 2204 powershell.exe Token: SeProfSingleProcessPrivilege 2204 powershell.exe Token: SeIncBasePriorityPrivilege 2204 powershell.exe Token: SeCreatePagefilePrivilege 2204 powershell.exe Token: SeBackupPrivilege 2204 powershell.exe Token: SeRestorePrivilege 2204 powershell.exe Token: SeShutdownPrivilege 2204 powershell.exe Token: SeDebugPrivilege 2204 powershell.exe Token: SeSystemEnvironmentPrivilege 2204 powershell.exe Token: SeRemoteShutdownPrivilege 2204 powershell.exe Token: SeUndockPrivilege 2204 powershell.exe Token: SeManageVolumePrivilege 2204 powershell.exe Token: 33 2204 powershell.exe Token: 34 2204 powershell.exe Token: 35 2204 powershell.exe Token: 36 2204 powershell.exe Token: SeDebugPrivilege 1704 powershell.exe Token: SeIncreaseQuotaPrivilege 1704 powershell.exe Token: SeSecurityPrivilege 1704 powershell.exe Token: SeTakeOwnershipPrivilege 1704 powershell.exe Token: SeLoadDriverPrivilege 1704 powershell.exe Token: SeSystemProfilePrivilege 1704 powershell.exe Token: SeSystemtimePrivilege 1704 powershell.exe Token: SeProfSingleProcessPrivilege 1704 powershell.exe Token: SeIncBasePriorityPrivilege 1704 powershell.exe Token: SeCreatePagefilePrivilege 1704 powershell.exe Token: SeBackupPrivilege 1704 powershell.exe Token: SeRestorePrivilege 1704 powershell.exe Token: SeShutdownPrivilege 1704 powershell.exe Token: SeDebugPrivilege 1704 powershell.exe Token: SeSystemEnvironmentPrivilege 1704 powershell.exe Token: SeRemoteShutdownPrivilege 1704 powershell.exe Token: SeUndockPrivilege 1704 powershell.exe Token: SeManageVolumePrivilege 1704 powershell.exe Token: 33 1704 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4144 XClient.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4144 wrote to memory of 2724 4144 XClient.exe 74 PID 4144 wrote to memory of 2724 4144 XClient.exe 74 PID 4144 wrote to memory of 2204 4144 XClient.exe 77 PID 4144 wrote to memory of 2204 4144 XClient.exe 77 PID 4144 wrote to memory of 1704 4144 XClient.exe 79 PID 4144 wrote to memory of 1704 4144 XClient.exe 79 PID 4144 wrote to memory of 5056 4144 XClient.exe 81 PID 4144 wrote to memory of 5056 4144 XClient.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2724
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2204
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1704
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD58592ba100a78835a6b94d5949e13dfc1
SHA163e901200ab9a57c7dd4c078d7f75dcd3b357020
SHA256fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c
SHA51287f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3
-
Filesize
1KB
MD50c8024f33f8ba74065f45280501f297b
SHA1cc6553e92ba363804bcd2d6191342707edca95d2
SHA2563860d7b5611d1ba75606516f9d841ddd806bd975b000111a605a06f8026fd30c
SHA512180232d4fb132c0e6dfbdc191cb6f0dffd20f67c1f1f93e539decbf9250bbd86f9f6b4b354520afd12acdc5b6fd494f3f7726b801a55a76b197ad38849683266
-
Filesize
1KB
MD5621ced8d6fc082aa3f5289bd8b23789b
SHA137791b32e521d2cee56dd089b3a7670b8ff5e19b
SHA256041129a8ffc33ed0ece9e6a03d77d5bf6a84d3dcf2d8706fafc442f6eb4729f8
SHA5125f2d2ee29f4a068bd3a52b0dd5bfc60d7d96fdb3ec6e1d573205d6335ff995d713c3bbd4298ccb1a20c8c750e128f8680c1f4aa499df5179941e4ff15fa032fa
-
Filesize
1KB
MD512ce32cdb860ea27c099070bd8739917
SHA10316c3dcd8f5926dc125427a2220526e53b2b1c6
SHA256cea8621365f1e4a19ccdbc46ef431635352d68753fc939f7412df3181080f6bd
SHA51269da9c85c8068dfcef7267154215047aa3743a80724b60558f22c66237e04b24737d14dea19b7d8d8a7236da32d4fe9b4a48af04f22f61f54c5a69af1bc0ca95
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a