Overview

overview

10

Static

static

10

XClient.exe

windows10-1703-x64

XClient.exe

windows7-x64

XClient.exe

windows10-1703-x64

XClient.exe

windows10-2004-x64

XClient.exe

windows11-21h2-x64

Analysis

  • max time kernel
    253s
  • max time network
    255s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    08/08/2024, 10:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    XClient.exe
  • Size 283KB
  • Sample240808-md9krssdkn
  • SHA256 6639082eb40e90f37ad92b3616c2040937355c5196ba241340cb1e8719d098df
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xwormexecutionpersistencerattrojan

Malware Config

Extracted

Family

  • xworm

C2

  • hard-tyler.gl.at.ply.gg:27490

Attributes
  • Install_directory

    %Temp%

  • install_file

    systemprocess.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: MapViewOfSection 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4880
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1352
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3100
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\systemprocess.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3356
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'systemprocess.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:1736
    • C:\Windows\SYSTEM32\shutdown.exe
      shutdown.exe /f /s /t 0
      2⤵
        PID:5032
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1572
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      PID:2852
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4072
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:664
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:1736
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      PID:2356
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      PID:2420
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      PID:304
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x0 /state0:0xa3aff055 /state1:0x41c64e6d
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:2912
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
        PID:872
      • C:\Windows\system32\browser_broker.exe
        C:\Windows\system32\browser_broker.exe -Embedding
        1⤵
          PID:3212

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              powershell.exe.log
              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
              • Size 3KB
              • SHA256 c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033
              • MD5 SHA1 SHA512
              Submit Download

              edgecompatviewlist[1].xml
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XCFODRP5\edgecompatviewlist[1].xml
              • Size 74KB
              • SHA256 853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 8672b635caf4876c0b4a80e690de4aa28853a35284642f940fd5f80d7e56dfd8
              • MD5 SHA1 SHA512
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 6b995f878df1e663e5c0bf515554ad6969818eb4885f7d56399e80c0ff9b391e
              • MD5 SHA1 SHA512
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 74056737a14b44ae138b3f13fcc45f86b311bf47f6bbe8486a4185c4b720c450
              • MD5 SHA1 SHA512
              Submit Download

              crypto-js.min[1].js
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\K0E1W6HH\crypto-js.min[1].js
              • Size 46KB
              • SHA256 eab5d90a71736f267af39fdf32caa8c71673fd06703279b01e0f92b0d7be0bfc
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              guns-solid[1].svg
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\2V53MIUH\guns-solid[1].svg
              • Size 732B
              • SHA256 e07f17964bb0c49b975f385542abb2f6c55e67b3b0d3b77c4d743fe3416553c4
              • MD5 SHA1 SHA512
              Submit Download

              suggestions[1].en-US
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\J66WWIB2\suggestions[1].en-US
              • Size 17KB
              • SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              __PSScriptPolicyTest_l4120fme.0hp.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l4120fme.0hp.ps1
              • Size 1B
              • SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
              • MD5 SHA1 SHA512
              Submit Download

              memory/664-230-0x000001F5BD800000-0x000001F5BD900000-memory.dmp
              Download

              memory/664-232-0x000001F5BD800000-0x000001F5BD900000-memory.dmp
              Download

              memory/1352-51-0x00007FFA64190000-0x00007FFA64B7C000-memory.dmp
              Download

              memory/1352-13-0x000001FBECC70000-0x000001FBECCE6000-memory.dmp
              Download

              memory/1352-12-0x00007FFA64190000-0x00007FFA64B7C000-memory.dmp
              Download

              memory/1352-10-0x00007FFA64190000-0x00007FFA64B7C000-memory.dmp
              Download

              memory/1352-8-0x00007FFA64190000-0x00007FFA64B7C000-memory.dmp
              Download

              memory/1352-7-0x000001FBECAC0000-0x000001FBECAE2000-memory.dmp
              Download

              memory/1572-223-0x0000019D1B380000-0x0000019D1B382000-memory.dmp
              Download

              memory/1572-549-0x0000019D22F30000-0x0000019D22F31000-memory.dmp
              Download

              memory/1572-188-0x0000019D1C220000-0x0000019D1C230000-memory.dmp
              Download

              memory/1572-204-0x0000019D1C320000-0x0000019D1C330000-memory.dmp
              Download

              memory/1572-548-0x0000019D22F20000-0x0000019D22F21000-memory.dmp
              Download

              memory/1736-296-0x0000015BFDBB0000-0x0000015BFDBB2000-memory.dmp
              Download

              memory/1736-246-0x0000015BABC00000-0x0000015BABC02000-memory.dmp
              Download

              memory/1736-250-0x0000015BABFA0000-0x0000015BAC0A0000-memory.dmp
              Download

              memory/1736-298-0x0000015BFDBD0000-0x0000015BFDBD2000-memory.dmp
              Download

              memory/1736-241-0x0000015BAB8B0000-0x0000015BAB8B2000-memory.dmp
              Download

              memory/1736-301-0x0000015BFDD60000-0x0000015BFDD62000-memory.dmp
              Download

              memory/1736-244-0x0000015BAB8E0000-0x0000015BAB8E2000-memory.dmp
              Download

              memory/1736-340-0x0000015BCCE40000-0x0000015BCCF40000-memory.dmp
              Download

              memory/4880-185-0x00007FFA64190000-0x00007FFA64B7C000-memory.dmp
              Download

              memory/4880-186-0x000000001C170000-0x000000001C17C000-memory.dmp
              Download

              memory/4880-0-0x00007FFA64193000-0x00007FFA64194000-memory.dmp
              Download

              memory/4880-2-0x00007FFA64190000-0x00007FFA64B7C000-memory.dmp
              Download

              memory/4880-1-0x00000000007E0000-0x000000000082C000-memory.dmp
              Download

              memory/4880-668-0x00007FFA64190000-0x00007FFA64B7C000-memory.dmp
              Download