Analysis
-
max time kernel
340s -
max time network
320s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
06-10-2024 11:40
General
-
Target
XWorm-5.6-main/Xworm V5.6.exe
-
Size
14.9MB
-
MD5
56ccb739926a725e78a7acf9af52c4bb
-
SHA1
5b01b90137871c3c8f0d04f510c4d56b23932cbc
-
SHA256
90f58865f265722ab007abb25074b3fc4916e927402552c6be17ef9afac96405
-
SHA512
2fee662bc4a1a36ce7328b23f991fa4a383b628839e403d6eb6a9533084b17699a6c939509867a86e803aafef2f9def98fa9305b576dad754aa7f599920c19a1
-
SSDEEP
196608:P4/BAe1d4ihvy85JhhYc3BSL1kehn4inje:PuyIhhkRka4i
Malware Config
Extracted
xworm
5.0
127.0.0.1:7000
SlX9k1N7cEJty72A
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 3 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Modifies registry class 55 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 27 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWorm-5.6-main\Xworm V5.6.exe"C:\Users\Admin\AppData\Local\Temp\XWorm-5.6-main\Xworm V5.6.exe"1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jxkpvilj\jxkpvilj.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6696.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc961846EFC4674B4281A3636C18194BD.TMP"3⤵
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x35c 0x3641⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\XClient.exe"C:\Users\Admin\Desktop\XClient.exe"1⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\XClient.exeC:\Users\Admin\AppData\Roaming\XClient.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5aa789ed7cab10da9ed348107c9f0a1bd
SHA1c355af770ebbc8e7c8d24ae9c86e6eb647ddd558
SHA25641b8920f459ce4a39f9d8cef95d5bdc29294f831faf3c12cf482430aeb96280d
SHA51285a30baeb57305db97fa21c04031f7567d47156b3cb51c6668f276cf604067c8b944b8b0f5db4321587c8aac35efd7e335a46ac1443cad043f025033048b7bea
-
Filesize
78KB
MD591790df1d4f35ae445fb5b7937523855
SHA1e396c990c904b1636d92c5f6fc35f46f895aaf3f
SHA256a1d49c92cc9754be9fa6bf2a22ce749504a0e4eb747964d341d9207b4f4b3fbe
SHA512716da31a86145013bf3ca299610111108d8a5e2e2ea618d5d839f295570cf452f1934cfe958c825c3b981bcbd54adcbeb2791cc57293de420a907f544668d64c
-
Filesize
290B
MD5df557c0282c51a0268aa0ee59e816108
SHA1f51fa5dc858e1737de98e80d9520038a92e25d0d
SHA25678bd425c8e848049b2800a48d6ae524febe00e99abc56e7539603171f289fb98
SHA512ff033ca9cd41448e314f1a973a57501cab7b57f0cbfed9890a101fdac2f58a9c9e80243ba032c18df319e00bd99dc6eb1981a12feb30ada7a581e696b5d23f07
-
Filesize
1KB
MD5d40c58bd46211e4ffcbfbdfac7c2bb69
SHA1c5cf88224acc284a4e81bd612369f0e39f3ac604
SHA25601902f1903d080c6632ae2209136e8e713e9fd408db4621ae21246b65bfea2ca
SHA51248b14748e86b7d92a3ea18f29caf1d7b4b2e1de75377012378d146575048a2531d2e5aaeae1abf2d322d06146177cdbf0c2940ac023efae007b9f235f18e2c68
-
Filesize
35KB
MD578bc5c9fb69ef8d546a02bf71aedda00
SHA1c8ec93c15117dcf705439909c307fbe100fc2af7
SHA256733f9b631442a5b40f186466575f75812690fe40b4bf0a67a809334301b1e2dc
SHA51273955632066cd98999068672ceb452e54878189ccf2b7301596cbeff2631a2ef79867c2cf22d41fca7ae3ed9141ce438216ff797b4872cdd60821714adba17d2
-
Filesize
10.8MB
-
Filesize
2.0MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
1.4MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
14.9MB
-
Filesize
10.8MB
-
Filesize
520KB
-
Filesize
176KB
-
Filesize
2.9MB
-
Filesize
712KB
-
Filesize
48KB
-
Filesize
568KB
-
Filesize
64KB