Overview

overview

10

Static

static

10

XClient.exe

windows10-1703-x64

XClient.exe

windows7-x64

XClient.exe

windows10-1703-x64

XClient.exe

windows10-2004-x64

XClient.exe

windows11-21h2-x64

Analysis

  • max time kernel
    254s
  • max time network
    255s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    08/08/2024, 10:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    XClient.exe
  • Size 283KB
  • Sample240808-md9krssdkn
  • SHA256 6639082eb40e90f37ad92b3616c2040937355c5196ba241340cb1e8719d098df
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xwormexecutionpersistencerattrojan

Malware Config

Extracted

Family

  • xworm

C2

  • hard-tyler.gl.at.ply.gg:27490

Attributes
  • Install_directory

    %Temp%

  • install_file

    systemprocess.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: MapViewOfSection 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3700
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1688
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:308
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\systemprocess.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:364
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'systemprocess.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:4476
    • C:\Windows\SYSTEM32\shutdown.exe
      shutdown.exe /f /s /t 0
      2⤵
        PID:3576
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4116
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      PID:2932
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2972
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1044
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:4904
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      PID:3204
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x0 /state0:0xa3aff055 /state1:0x41c64e6d
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:4052
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
        PID:420
      • C:\Windows\system32\browser_broker.exe
        C:\Windows\system32\browser_broker.exe -Embedding
        1⤵
          PID:3308

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              powershell.exe.log
              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
              • Size 3KB
              • SHA256 fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c
              • MD5 SHA1 SHA512
              Submit Download

              edgecompatviewlist[1].xml
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\L5P12AEX\edgecompatviewlist[1].xml
              • Size 74KB
              • SHA256 853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 4870e6eeb0b4db5c852576b58a566b9120b801dfa200077ab11f1a630d70f0ab
              • MD5 SHA1 SHA512
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 6112d22d06f8d5ff04ebc6ee59003e379464eb5e3f2f30abcd21e45d5fe29f52
              • MD5 SHA1 SHA512
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 931f8945d61d980886be54a86d336a672b3d5a04efef4f48a9de2171882fe047
              • MD5 SHA1 SHA512
              Submit Download

              crypto-js.min[1].js
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\WN3ARXN2\crypto-js.min[1].js
              • Size 46KB
              • SHA256 eab5d90a71736f267af39fdf32caa8c71673fd06703279b01e0f92b0d7be0bfc
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              guns-solid[1].svg
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\2X206TA8\guns-solid[1].svg
              • Size 732B
              • SHA256 e07f17964bb0c49b975f385542abb2f6c55e67b3b0d3b77c4d743fe3416553c4
              • MD5 SHA1 SHA512
              Submit Download

              suggestions[1].en-US
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\WX2JLRZY\suggestions[1].en-US
              • Size 17KB
              • SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              __PSScriptPolicyTest_fj3j44nv.zru.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fj3j44nv.zru.ps1
              • Size 1B
              • SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
              • MD5 SHA1 SHA512
              Submit Download

              memory/1044-233-0x0000028B84080000-0x0000028B84180000-memory.dmp
              Download

              memory/1044-232-0x0000028B84080000-0x0000028B84180000-memory.dmp
              Download

              memory/1688-10-0x00007FF8BAF80000-0x00007FF8BB96C000-memory.dmp
              Download

              memory/1688-51-0x00007FF8BAF80000-0x00007FF8BB96C000-memory.dmp
              Download

              memory/1688-13-0x000001AD5F2A0000-0x000001AD5F316000-memory.dmp
              Download

              memory/1688-9-0x00007FF8BAF80000-0x00007FF8BB96C000-memory.dmp
              Download

              memory/1688-8-0x000001AD5F0F0000-0x000001AD5F112000-memory.dmp
              Download

              memory/1688-7-0x00007FF8BAF80000-0x00007FF8BB96C000-memory.dmp
              Download

              memory/3700-185-0x00007FF8BAF83000-0x00007FF8BAF84000-memory.dmp
              Download

              memory/3700-186-0x00007FF8BAF80000-0x00007FF8BB96C000-memory.dmp
              Download

              memory/3700-187-0x000000001C070000-0x000000001C07C000-memory.dmp
              Download

              memory/3700-656-0x00007FF8BAF80000-0x00007FF8BB96C000-memory.dmp
              Download

              memory/3700-0-0x00007FF8BAF83000-0x00007FF8BAF84000-memory.dmp
              Download

              memory/3700-2-0x00007FF8BAF80000-0x00007FF8BB96C000-memory.dmp
              Download

              memory/3700-1-0x0000000000790000-0x00000000007DC000-memory.dmp
              Download

              memory/4116-205-0x000001C39E820000-0x000001C39E830000-memory.dmp
              Download

              memory/4116-575-0x000001C3A54D0000-0x000001C3A54D1000-memory.dmp
              Download

              memory/4116-574-0x000001C3A4CF0000-0x000001C3A4CF1000-memory.dmp
              Download

              memory/4116-224-0x000001C39D7E0000-0x000001C39D7E2000-memory.dmp
              Download

              memory/4116-189-0x000001C39E720000-0x000001C39E730000-memory.dmp
              Download

              memory/4904-251-0x000002252FE00000-0x000002252FF00000-memory.dmp
              Download

              memory/4904-299-0x0000022571870000-0x0000022571872000-memory.dmp
              Download

              memory/4904-297-0x0000022571850000-0x0000022571852000-memory.dmp
              Download

              memory/4904-307-0x0000022572160000-0x0000022572162000-memory.dmp
              Download

              memory/4904-242-0x000002252F4F0000-0x000002252F4F2000-memory.dmp
              Download

              memory/4904-365-0x000002252FE00000-0x000002252FF00000-memory.dmp
              Download

              memory/4904-247-0x000002252F540000-0x000002252F542000-memory.dmp
              Download

              memory/4904-245-0x000002252F520000-0x000002252F522000-memory.dmp
              Download