Overview
overview
10Static
static
10Archive.zip
windows10-1703-x64
1Dropper/Berbew.exe
windows10-1703-x64
10Dropper/Phorphiex.exe
windows10-1703-x64
10out.exe
windows10-1703-x64
3RAT/31.exe
windows10-1703-x64
10RAT/XClient.exe
windows10-1703-x64
10RAT/file.exe
windows10-1703-x64
7Ransomware...-2.exe
windows10-1703-x64
10Ransomware...01.exe
windows10-1703-x64
10Ransomware...lt.exe
windows10-1703-x64
10Stealers/Azorult.exe
windows10-1703-x64
10Stealers/B...on.exe
windows10-1703-x64
10Stealers/Dridex.dll
windows10-1703-x64
10Stealers/M..._2.exe
windows10-1703-x64
10Stealers/lumma.exe
windows10-1703-x64
10Trojan/BetaBot.exe
windows10-1703-x64
10Trojan/Smo...er.exe
windows10-1703-x64
10Resubmissions
03-09-2024 14:02
240903-rb57sazdqf 1003-09-2024 13:51
240903-q59avszclf 1002-09-2024 19:51
240902-yk8gtsxbpd 1002-09-2024 02:27
240902-cxh7tazflg 1002-09-2024 02:26
240902-cwxc2sygll 1021-06-2024 19:37
240621-yca7cszgnd 1009-06-2024 17:07
240609-vm7rjadd73 1013-05-2024 17:36
240513-v6qblafe3y 1012-05-2024 17:17
240512-vty3zafh5s 10Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
02-09-2024 02:27
Behavioral task
behavioral1
Sample
Archive.zip
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Dropper/Berbew.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Dropper/Phorphiex.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
out.exe
Resource
win10-20240611-en
Behavioral task
behavioral5
Sample
RAT/31.exe
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
RAT/XClient.exe
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
RAT/file.exe
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
Ransomware/Client-2.exe
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
Ransomware/criticalupdate01.exe
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
Ransomware/default.exe
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
Stealers/Azorult.exe
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
Stealers/BlackMoon.exe
Resource
win10-20240404-en
Behavioral task
behavioral13
Sample
Stealers/Dridex.dll
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win10-20240611-en
Behavioral task
behavioral15
Sample
Stealers/lumma.exe
Resource
win10-20240404-en
Behavioral task
behavioral16
Sample
Trojan/BetaBot.exe
Resource
win10-20240404-en
Behavioral task
behavioral17
Sample
Trojan/SmokeLoader.exe
Resource
win10-20240404-en
General
-
Target
RAT/XClient.exe
-
Size
172KB
-
MD5
75ba783757c5b61bd841afa136fc3eda
-
SHA1
8db9cda9508471a23f9b743027fa115e01bc1fe1
-
SHA256
75a8719e83e4aecbe51287d7bfaf1e334fa190c7784324f24bcf61ab984de20a
-
SHA512
9a6cfbf4302336662527837bf60b30b458f8d438bd6e9563093d4948bf81c79d56578e965d836e90aafde553d1cdc9c6df81a254aafcfb3379fbe6405dce0ea1
-
SSDEEP
1536:vJcr5kCyoAp30kaF6CiJzt7UbjFdZe8e6TOAJkU7JsOpysa7iAMI:BcmNNxda6zZUbjHZe8jO6H2OpYuAf
Malware Config
Extracted
xworm
-
Install_directory
%AppData%
-
install_file
XClient.exe
-
pastebin_url
https://pastebin.com/raw/2jTT3Lnj
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral6/memory/3928-1-0x0000000000B60000-0x0000000000B90000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 3636 powershell.exe 1720 powershell.exe 5012 powershell.exe 664 powershell.exe -
Drops startup file 2 IoCs
Processes:
XClient.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk XClient.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk XClient.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
XClient.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe" XClient.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
Processes:
flow ioc 4 pastebin.com 5 pastebin.com 8 7.tcp.eu.ngrok.io 16 7.tcp.eu.ngrok.io 36 7.tcp.eu.ngrok.io -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exeXClient.exepid process 5012 powershell.exe 5012 powershell.exe 5012 powershell.exe 664 powershell.exe 664 powershell.exe 664 powershell.exe 3636 powershell.exe 3636 powershell.exe 3636 powershell.exe 1720 powershell.exe 1720 powershell.exe 1720 powershell.exe 3928 XClient.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
XClient.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3928 XClient.exe Token: SeDebugPrivilege 5012 powershell.exe Token: SeIncreaseQuotaPrivilege 5012 powershell.exe Token: SeSecurityPrivilege 5012 powershell.exe Token: SeTakeOwnershipPrivilege 5012 powershell.exe Token: SeLoadDriverPrivilege 5012 powershell.exe Token: SeSystemProfilePrivilege 5012 powershell.exe Token: SeSystemtimePrivilege 5012 powershell.exe Token: SeProfSingleProcessPrivilege 5012 powershell.exe Token: SeIncBasePriorityPrivilege 5012 powershell.exe Token: SeCreatePagefilePrivilege 5012 powershell.exe Token: SeBackupPrivilege 5012 powershell.exe Token: SeRestorePrivilege 5012 powershell.exe Token: SeShutdownPrivilege 5012 powershell.exe Token: SeDebugPrivilege 5012 powershell.exe Token: SeSystemEnvironmentPrivilege 5012 powershell.exe Token: SeRemoteShutdownPrivilege 5012 powershell.exe Token: SeUndockPrivilege 5012 powershell.exe Token: SeManageVolumePrivilege 5012 powershell.exe Token: 33 5012 powershell.exe Token: 34 5012 powershell.exe Token: 35 5012 powershell.exe Token: 36 5012 powershell.exe Token: SeDebugPrivilege 664 powershell.exe Token: SeIncreaseQuotaPrivilege 664 powershell.exe Token: SeSecurityPrivilege 664 powershell.exe Token: SeTakeOwnershipPrivilege 664 powershell.exe Token: SeLoadDriverPrivilege 664 powershell.exe Token: SeSystemProfilePrivilege 664 powershell.exe Token: SeSystemtimePrivilege 664 powershell.exe Token: SeProfSingleProcessPrivilege 664 powershell.exe Token: SeIncBasePriorityPrivilege 664 powershell.exe Token: SeCreatePagefilePrivilege 664 powershell.exe Token: SeBackupPrivilege 664 powershell.exe Token: SeRestorePrivilege 664 powershell.exe Token: SeShutdownPrivilege 664 powershell.exe Token: SeDebugPrivilege 664 powershell.exe Token: SeSystemEnvironmentPrivilege 664 powershell.exe Token: SeRemoteShutdownPrivilege 664 powershell.exe Token: SeUndockPrivilege 664 powershell.exe Token: SeManageVolumePrivilege 664 powershell.exe Token: 33 664 powershell.exe Token: 34 664 powershell.exe Token: 35 664 powershell.exe Token: 36 664 powershell.exe Token: SeDebugPrivilege 3636 powershell.exe Token: SeIncreaseQuotaPrivilege 3636 powershell.exe Token: SeSecurityPrivilege 3636 powershell.exe Token: SeTakeOwnershipPrivilege 3636 powershell.exe Token: SeLoadDriverPrivilege 3636 powershell.exe Token: SeSystemProfilePrivilege 3636 powershell.exe Token: SeSystemtimePrivilege 3636 powershell.exe Token: SeProfSingleProcessPrivilege 3636 powershell.exe Token: SeIncBasePriorityPrivilege 3636 powershell.exe Token: SeCreatePagefilePrivilege 3636 powershell.exe Token: SeBackupPrivilege 3636 powershell.exe Token: SeRestorePrivilege 3636 powershell.exe Token: SeShutdownPrivilege 3636 powershell.exe Token: SeDebugPrivilege 3636 powershell.exe Token: SeSystemEnvironmentPrivilege 3636 powershell.exe Token: SeRemoteShutdownPrivilege 3636 powershell.exe Token: SeUndockPrivilege 3636 powershell.exe Token: SeManageVolumePrivilege 3636 powershell.exe Token: 33 3636 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
XClient.exepid process 3928 XClient.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
XClient.exedescription pid process target process PID 3928 wrote to memory of 5012 3928 XClient.exe powershell.exe PID 3928 wrote to memory of 5012 3928 XClient.exe powershell.exe PID 3928 wrote to memory of 664 3928 XClient.exe powershell.exe PID 3928 wrote to memory of 664 3928 XClient.exe powershell.exe PID 3928 wrote to memory of 3636 3928 XClient.exe powershell.exe PID 3928 wrote to memory of 3636 3928 XClient.exe powershell.exe PID 3928 wrote to memory of 1720 3928 XClient.exe powershell.exe PID 3928 wrote to memory of 1720 3928 XClient.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RAT\XClient.exe"C:\Users\Admin\AppData\Local\Temp\RAT\XClient.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RAT\XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5012
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:664
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3636
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1720
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD58592ba100a78835a6b94d5949e13dfc1
SHA163e901200ab9a57c7dd4c078d7f75dcd3b357020
SHA256fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c
SHA51287f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3
-
Filesize
1KB
MD56e1a132ea36181b103e02d463da0e0bf
SHA1160620eac2b420a8e7386eba606fee8d0d708806
SHA256c4537fb44d5808f6450d8ee2ac61c963bd2c6e3e650e7b48b5d83b5d11d2b30a
SHA5123034a371f9c3c70ee7fed8e71544034aaff972ca30b729c8a9ea2e5486b35157e29f2f8c7a9cbc374488aeb2f2c0dacf177b71231a62ce76e59a2f0cd445f2b5
-
Filesize
1KB
MD5a80ff6cefb84e519d8943755966fe9ac
SHA1269fa826a6a0ec6979cd1e5f58dac18d33f7019a
SHA256757e1059a78096f4c5a7481323f411001d60aadc90ee96f192421b7765177e27
SHA51215284c2238a7efadeeef952431d7e2195885c011b2c94cddc7357aec5039d461eaf50cdeea8b0aca8cd809c6f0cb784cb0c076f5c79dfed8c52f21b9e39d2d6a
-
Filesize
1KB
MD5e7a4c24b86dff71e27d7be17baad98c2
SHA18e0340cdf9d76314192d5df9a0a7fc451725858d
SHA256aee56697d10648b7f7a580c40b9cc38db98a6c8d47f77a58aa889f151daefeba
SHA512c81dc67e33040e2b6cc960474191f9643c5ac7d5a02d1dfd2f86c551320115efe448288b68d31aafb3df1f723a7756d0570cdf32d8e089f1f64626153221d0e3
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a