Analysis
-
max time kernel
150s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/09/2024, 18:17
Behavioral task
behavioral1
Sample
XClientpidaras.exe
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
150 seconds
General
-
Target
XClientpidaras.exe
-
Size
69KB
-
MD5
a707d15921c6043a7fbb95dd94b0bd68
-
SHA1
0ba8feed0de0b26ecc7e86c8dc33a1e961176075
-
SHA256
8615911309f47f5540b2a3d340a12320dda86d2a029ed358315f3e3dac9fef08
-
SHA512
2aa2ff6a434e71553171e257d723ecb319c9fc74ab9a2684e40d2b448421587f45cb8607a8d38e6ce731b04f0bc93013ffadf4441ec9750ed9d48893c110d237
-
SSDEEP
1536:UTYFWL2D3I3Ev4rIRzGgbTR6gkq0hjk6fVMKlXOebtQV:gYf7QczHbTRNgjrMAOebmV
Malware Config
Extracted
Family
xworm
Attributes
-
Install_directory
%Temp%
-
install_file
chyrka228.exe
-
pastebin_url
https://pastebin.com/raw/MdxXj6A4
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral2/memory/1060-1-0x00000000000D0000-0x00000000000E8000-memory.dmp family_xworm -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 17 ip-api.com -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1060 XClientpidaras.exe Token: SeDebugPrivilege 2272 taskmgr.exe Token: SeSystemProfilePrivilege 2272 taskmgr.exe Token: SeCreateGlobalPrivilege 2272 taskmgr.exe -
Suspicious use of FindShellTrayWindow 39 IoCs
pid Process 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe -
Suspicious use of SendNotifyMessage 39 IoCs
pid Process 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe 2272 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClientpidaras.exe"C:\Users\Admin\AppData\Local\Temp\XClientpidaras.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1060
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2272