Overview
overview
10Static
static
10XClient.exe
windows7-x64
10XClient.exe
windows10-1703-x64
10XClient.exe
windows10-2004-x64
10XClient.exe
windows11-21h2-x64
10XClient.exe
macos-10.15-amd64
1XClient.exe
macos-10.15-amd64
4XClient.exe
ubuntu-18.04-amd64
XClient.exe
debian-9-armhf
XClient.exe
debian-9-mips
XClient.exe
debian-9-mipsel
Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240730-en -
resource tags
arch:x64arch:x86image:win11-20240730-enlocale:en-usos:windows11-21h2-x64system -
submitted
01-08-2024 20:59
Behavioral task
behavioral1
Sample
XClient.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
XClient.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
XClient.exe
Resource
win10v2004-20240730-en
Behavioral task
behavioral4
Sample
XClient.exe
Resource
win11-20240730-en
Behavioral task
behavioral5
Sample
XClient.exe
Resource
macos-20240711.1-en
Behavioral task
behavioral6
Sample
XClient.exe
Resource
macos-20240711.1-en
Behavioral task
behavioral7
Sample
XClient.exe
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral8
Sample
XClient.exe
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral9
Sample
XClient.exe
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral10
Sample
XClient.exe
Resource
debian9-mipsel-20240611-en
General
-
Target
XClient.exe
-
Size
80KB
-
MD5
bfa950b37b6a4f8de71af861e677a8b4
-
SHA1
2ee40bfbf2964d92c82256e5924169295dfdd225
-
SHA256
07f94f8f6061ba95899914496edc5854aa810de56797d9004875276d60e21ade
-
SHA512
235b514fac01b24edaef3aeb4209676789b6ba9264a8798cb7ae48c26d2455cdd8f254e92bbba688535acb69fd77b3c0a0a549cf97ece84c235cc74f72234e1a
-
SSDEEP
1536:EI5NuEGJkEtydWqZQSp1eS+b59gxzhfxdl/5m6qeo//3Oy/4IK4Dax5:Eg1GhtktQGAS+b59cJ4eA/OlINDab
Malware Config
Extracted
xworm
full-self.gl.at.ply.gg:45212
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral4/memory/4044-1-0x0000000000AF0000-0x0000000000B0A000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 3760 powershell.exe 1928 powershell.exe 4980 powershell.exe 5068 powershell.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
XClient.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2803179037-308240136-4183858629-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe" XClient.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exeXClient.exepid process 4980 powershell.exe 4980 powershell.exe 5068 powershell.exe 5068 powershell.exe 3760 powershell.exe 3760 powershell.exe 1928 powershell.exe 1928 powershell.exe 4044 XClient.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
XClient.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 4044 XClient.exe Token: SeDebugPrivilege 4980 powershell.exe Token: SeDebugPrivilege 5068 powershell.exe Token: SeDebugPrivilege 3760 powershell.exe Token: SeDebugPrivilege 1928 powershell.exe Token: SeDebugPrivilege 4044 XClient.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
XClient.exepid process 4044 XClient.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
XClient.exedescription pid process target process PID 4044 wrote to memory of 4980 4044 XClient.exe powershell.exe PID 4044 wrote to memory of 4980 4044 XClient.exe powershell.exe PID 4044 wrote to memory of 5068 4044 XClient.exe powershell.exe PID 4044 wrote to memory of 5068 4044 XClient.exe powershell.exe PID 4044 wrote to memory of 3760 4044 XClient.exe powershell.exe PID 4044 wrote to memory of 3760 4044 XClient.exe powershell.exe PID 4044 wrote to memory of 1928 4044 XClient.exe powershell.exe PID 4044 wrote to memory of 1928 4044 XClient.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4980 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5068 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3760 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1928
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5627073ee3ca9676911bee35548eff2b8
SHA14c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA25685b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA5123c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD51d3ea4fc04f2e2793ab2b91e9c428f63
SHA1f0a18c9491bf229e1eec8e135e01dcb9d13ef235
SHA256d25d8d12f8c81a4174ffc074fe69fa49bab60553f4aec9f4b0c32c7b902f4147
SHA512bec76dca6bc34f040fc265ca065bb94d76d9e67b507182f7119aa5f98930942aa665b9709b6a59802e28a1c56b94fdad4ed4d7e6cdf9de79f035d5b9773d6897
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD59c17c22a76423820c77e72c3ba30d2eb
SHA17d3069772ed2309fa705194cbe1976abf8393f29
SHA25623310e93522704cfc5a4792d77be53eab23a91213b23667a4e00ece57044972e
SHA512ef3986e3d7d91946588cba16005a7f36185176b614e2e503fddcca8f71e8fccfc156f05554b552306128c3969a46b8a4e6e711c9b4b6e9b85781321e2c59384e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5781da0576417bf414dc558e5a315e2be
SHA1215451c1e370be595f1c389f587efeaa93108b4c
SHA25641a5aef8b0bbeea2766f40a7bba2c78322379f167c610f7055ccb69e7db030fe
SHA51224e283aa30a2903ebe154dad49b26067a45e46fec57549ad080d3b9ec3f272044efaaed3822d067837f5521262192f466c47195ffe7f75f8c7c5dcf3159ea737
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4wrp4rsh.stq.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/4044-1-0x0000000000AF0000-0x0000000000B0A000-memory.dmpFilesize
104KB
-
memory/4044-51-0x00007FF82F100000-0x00007FF82FBC2000-memory.dmpFilesize
10.8MB
-
memory/4044-0-0x00007FF82F103000-0x00007FF82F105000-memory.dmpFilesize
8KB
-
memory/4044-50-0x00007FF82F100000-0x00007FF82FBC2000-memory.dmpFilesize
10.8MB
-
memory/4980-3-0x00007FF82F100000-0x00007FF82FBC2000-memory.dmpFilesize
10.8MB
-
memory/4980-17-0x00007FF82F100000-0x00007FF82FBC2000-memory.dmpFilesize
10.8MB
-
memory/4980-16-0x00007FF82F100000-0x00007FF82FBC2000-memory.dmpFilesize
10.8MB
-
memory/4980-13-0x00007FF82F100000-0x00007FF82FBC2000-memory.dmpFilesize
10.8MB
-
memory/4980-12-0x00000207BF010000-0x00000207BF032000-memory.dmpFilesize
136KB
-
memory/4980-2-0x00007FF82F100000-0x00007FF82FBC2000-memory.dmpFilesize
10.8MB