Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/10/2024, 22:46

General

  • Target

    XClient.exe

  • Size

    33KB

  • MD5

    46af754270dd36d49444438d59d3dc03

  • SHA1

    3c7026e503ad99e027c441b386de18ab24417f54

  • SHA256

    6beed422d1b8dd262962ce2b277dfa8d6f852b4572ee818d77173eea1842be4b

  • SHA512

    38d39b06c945cc3690acb463f4fceea44a8bc6d3d5862fdde34ac86e060b06e88969f431029ff83b38f25e3dd616ef64f6e9eca21dbe4d2efdae1577f096a904

  • SSDEEP

    768:zB3hXuukvIi2lahqLeqdXFh9ZaO/hy/E33:93Euo32lahlqtFh9ZaO/kcH

Malware Config

Extracted

Family

xworm

Version

3.1

Mutex

Gz1k9z3viwF3Mfl2

Attributes
  • Install_directory

    %Public%

  • install_file

    USB.exe

  • pastebin_url

    https://pastebin.com/raw/J09JweeH

aes.plain

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 35 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1744
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Public\XClient.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2376
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1604
  • C:\Users\Public\XClient.exe
    C:\Users\Public\XClient.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4372
  • C:\Users\Public\XClient.exe
    C:\Users\Public\XClient.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4336
  • C:\Users\Public\XClient.exe
    C:\Users\Public\XClient.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3252

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XClient.exe.log

          Filesize

          654B

          MD5

          2ff39f6c7249774be85fd60a8f9a245e

          SHA1

          684ff36b31aedc1e587c8496c02722c6698c1c4e

          SHA256

          e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

          SHA512

          1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

          Filesize

          984B

          MD5

          973ea14666035a4b3e8526ebf4e643c6

          SHA1

          213003b1f5c903e68acfe2d5b1af4ca5e1b5a749

          SHA256

          7af6b94288551e3672926460382d488105ec71aa70a0f3db1a926cb2ccf0825b

          SHA512

          23598de7fd0887a754d347cef5d726e4262042926df7395d8d858e4d9927e90a7b44f7e1d331e649c9d705c31c261472f9e418338701a4aba8335402236473dc

        • C:\Users\Public\XClient.exe

          Filesize

          33KB

          MD5

          46af754270dd36d49444438d59d3dc03

          SHA1

          3c7026e503ad99e027c441b386de18ab24417f54

          SHA256

          6beed422d1b8dd262962ce2b277dfa8d6f852b4572ee818d77173eea1842be4b

          SHA512

          38d39b06c945cc3690acb463f4fceea44a8bc6d3d5862fdde34ac86e060b06e88969f431029ff83b38f25e3dd616ef64f6e9eca21dbe4d2efdae1577f096a904

        • memory/1604-22-0x0000022391A90000-0x0000022391A91000-memory.dmp

          Filesize

          4KB

        • memory/1604-20-0x0000022391A90000-0x0000022391A91000-memory.dmp

          Filesize

          4KB

        • memory/1604-12-0x0000022391A90000-0x0000022391A91000-memory.dmp

          Filesize

          4KB

        • memory/1604-13-0x0000022391A90000-0x0000022391A91000-memory.dmp

          Filesize

          4KB

        • memory/1604-23-0x0000022391A90000-0x0000022391A91000-memory.dmp

          Filesize

          4KB

        • memory/1604-17-0x0000022391A90000-0x0000022391A91000-memory.dmp

          Filesize

          4KB

        • memory/1604-21-0x0000022391A90000-0x0000022391A91000-memory.dmp

          Filesize

          4KB

        • memory/1604-11-0x0000022391A90000-0x0000022391A91000-memory.dmp

          Filesize

          4KB

        • memory/1604-19-0x0000022391A90000-0x0000022391A91000-memory.dmp

          Filesize

          4KB

        • memory/1604-18-0x0000022391A90000-0x0000022391A91000-memory.dmp

          Filesize

          4KB

        • memory/1744-0-0x00007FF867DA3000-0x00007FF867DA5000-memory.dmp

          Filesize

          8KB

        • memory/1744-10-0x00007FF867DA0000-0x00007FF868861000-memory.dmp

          Filesize

          10.8MB

        • memory/1744-26-0x00007FF867DA0000-0x00007FF868861000-memory.dmp

          Filesize

          10.8MB

        • memory/1744-1-0x0000000000B60000-0x0000000000B6E000-memory.dmp

          Filesize

          56KB