Overview
overview
10Static
static
10XClient.exe
windows7-x64
10XClient.exe
windows10-1703-x64
10XClient.exe
windows10-2004-x64
10XClient.exe
windows11-21h2-x64
10XClient.exe
macos-10.15-amd64
1XClient.exe
macos-10.15-amd64
4XClient.exe
ubuntu-18.04-amd64
XClient.exe
debian-9-armhf
XClient.exe
debian-9-mips
XClient.exe
debian-9-mipsel
Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
01-08-2024 20:59
Behavioral task
behavioral1
Sample
XClient.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
XClient.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
XClient.exe
Resource
win10v2004-20240730-en
Behavioral task
behavioral4
Sample
XClient.exe
Resource
win11-20240730-en
Behavioral task
behavioral5
Sample
XClient.exe
Resource
macos-20240711.1-en
Behavioral task
behavioral6
Sample
XClient.exe
Resource
macos-20240711.1-en
Behavioral task
behavioral7
Sample
XClient.exe
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral8
Sample
XClient.exe
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral9
Sample
XClient.exe
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral10
Sample
XClient.exe
Resource
debian9-mipsel-20240611-en
General
-
Target
XClient.exe
-
Size
80KB
-
MD5
bfa950b37b6a4f8de71af861e677a8b4
-
SHA1
2ee40bfbf2964d92c82256e5924169295dfdd225
-
SHA256
07f94f8f6061ba95899914496edc5854aa810de56797d9004875276d60e21ade
-
SHA512
235b514fac01b24edaef3aeb4209676789b6ba9264a8798cb7ae48c26d2455cdd8f254e92bbba688535acb69fd77b3c0a0a549cf97ece84c235cc74f72234e1a
-
SSDEEP
1536:EI5NuEGJkEtydWqZQSp1eS+b59gxzhfxdl/5m6qeo//3Oy/4IK4Dax5:Eg1GhtktQGAS+b59cJ4eA/OlINDab
Malware Config
Extracted
xworm
full-self.gl.at.ply.gg:45212
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral3/memory/4496-0-0x0000000000EF0000-0x0000000000F0A000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 4688 powershell.exe 4804 powershell.exe 60 powershell.exe 4636 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
XClient.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\Control Panel\International\Geo\Nation XClient.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
XClient.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe" XClient.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exeXClient.exepid process 4688 powershell.exe 4688 powershell.exe 4804 powershell.exe 4804 powershell.exe 60 powershell.exe 60 powershell.exe 4636 powershell.exe 4636 powershell.exe 4496 XClient.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
XClient.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 4496 XClient.exe Token: SeDebugPrivilege 4688 powershell.exe Token: SeDebugPrivilege 4804 powershell.exe Token: SeDebugPrivilege 60 powershell.exe Token: SeDebugPrivilege 4636 powershell.exe Token: SeDebugPrivilege 4496 XClient.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
XClient.exepid process 4496 XClient.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
XClient.exedescription pid process target process PID 4496 wrote to memory of 4688 4496 XClient.exe powershell.exe PID 4496 wrote to memory of 4688 4496 XClient.exe powershell.exe PID 4496 wrote to memory of 4804 4496 XClient.exe powershell.exe PID 4496 wrote to memory of 4804 4496 XClient.exe powershell.exe PID 4496 wrote to memory of 60 4496 XClient.exe powershell.exe PID 4496 wrote to memory of 60 4496 XClient.exe powershell.exe PID 4496 wrote to memory of 4636 4496 XClient.exe powershell.exe PID 4496 wrote to memory of 4636 4496 XClient.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4688 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4804 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:60 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD504f1d68afbed6b13399edfae1e9b1472
SHA18bfdcb687a995e4a63a8c32df2c66dc89f91a8b0
SHA256f358f33a42122e97c489fad7bbc8beab2eb42d42e4ec7fce0dd61fe6d8c0b8de
SHA51230c5e72a8134992094d937d2588f7a503b1d6407d11afe0265b7c8b0ce14071925e5caed13fc4f9c28705df4c7aed3601f81b007048b148af274d7784aa5fb75
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD50932425050325aa663cd612e38830a9c
SHA164a326a65fd6a0ac3b96e5adf655f2545cdf229b
SHA2562b0b750b3bd8a5b91e49139da437133761839ec216c74ac66db64ff1d0b65a0c
SHA512d41a82df25a8a5566a1a9b8aac769d6c72be8c2dc44cabbc809285fb77710468de71d1838cd44c52fdd599c26464377e2172fa27bf12c918b8363f7c7d649a48
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gppnetpc.kyn.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/60-42-0x00000215FDB60000-0x00000215FDD7C000-memory.dmpFilesize
2.1MB
-
memory/4496-1-0x00007FFBC2D23000-0x00007FFBC2D25000-memory.dmpFilesize
8KB
-
memory/4496-57-0x00007FFBC2D20000-0x00007FFBC37E1000-memory.dmpFilesize
10.8MB
-
memory/4496-0-0x0000000000EF0000-0x0000000000F0A000-memory.dmpFilesize
104KB
-
memory/4496-56-0x00007FFBC2D23000-0x00007FFBC2D25000-memory.dmpFilesize
8KB
-
memory/4496-55-0x00007FFBC2D20000-0x00007FFBC37E1000-memory.dmpFilesize
10.8MB
-
memory/4688-12-0x00007FFBC2D20000-0x00007FFBC37E1000-memory.dmpFilesize
10.8MB
-
memory/4688-18-0x00007FFBC2D20000-0x00007FFBC37E1000-memory.dmpFilesize
10.8MB
-
memory/4688-17-0x000002486CAB0000-0x000002486CCCC000-memory.dmpFilesize
2.1MB
-
memory/4688-14-0x00007FFBC2D20000-0x00007FFBC37E1000-memory.dmpFilesize
10.8MB
-
memory/4688-13-0x00007FFBC2D20000-0x00007FFBC37E1000-memory.dmpFilesize
10.8MB
-
memory/4688-11-0x000002486C530000-0x000002486C552000-memory.dmpFilesize
136KB