Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/10/2024, 22:47

General

  • Target

    XCliente.exe

  • Size

    33KB

  • MD5

    46af754270dd36d49444438d59d3dc03

  • SHA1

    3c7026e503ad99e027c441b386de18ab24417f54

  • SHA256

    6beed422d1b8dd262962ce2b277dfa8d6f852b4572ee818d77173eea1842be4b

  • SHA512

    38d39b06c945cc3690acb463f4fceea44a8bc6d3d5862fdde34ac86e060b06e88969f431029ff83b38f25e3dd616ef64f6e9eca21dbe4d2efdae1577f096a904

  • SSDEEP

    768:zB3hXuukvIi2lahqLeqdXFh9ZaO/hy/E33:93Euo32lahlqtFh9ZaO/kcH

Malware Config

Extracted

Family

xworm

Version

3.1

Mutex

Gz1k9z3viwF3Mfl2

Attributes
  • Install_directory

    %Public%

  • install_file

    USB.exe

  • pastebin_url

    https://pastebin.com/raw/J09JweeH

aes.plain

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of SendNotifyMessage 36 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\XCliente.exe
    "C:\Users\Admin\AppData\Local\Temp\XCliente.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2332
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XCliente" /tr "C:\Users\Public\XCliente.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:1668
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3952
  • C:\Users\Public\XCliente.exe
    C:\Users\Public\XCliente.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3784
  • C:\Users\Public\XCliente.exe
    C:\Users\Public\XCliente.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4672

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XCliente.exe.log

          Filesize

          654B

          MD5

          2ff39f6c7249774be85fd60a8f9a245e

          SHA1

          684ff36b31aedc1e587c8496c02722c6698c1c4e

          SHA256

          e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

          SHA512

          1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XCliente.lnk

          Filesize

          995B

          MD5

          6b0d884f20ad1362e502782423c8d87a

          SHA1

          0592204030ca102574a240611cd6ca2aa8d912ab

          SHA256

          14133a517672e7396abc44dec9d8706ade9f0134d6c190bb49c2a6646de2ea40

          SHA512

          32d596854a99222d097b59fb6b69a0856b1be48f6d5f94b86f98c8f82b492ef395c7301a4329d5ed700fa6badbddab8ede3012ca1c46f082fcc94fd8cbdc3612

        • C:\Users\Public\XCliente.exe

          Filesize

          33KB

          MD5

          46af754270dd36d49444438d59d3dc03

          SHA1

          3c7026e503ad99e027c441b386de18ab24417f54

          SHA256

          6beed422d1b8dd262962ce2b277dfa8d6f852b4572ee818d77173eea1842be4b

          SHA512

          38d39b06c945cc3690acb463f4fceea44a8bc6d3d5862fdde34ac86e060b06e88969f431029ff83b38f25e3dd616ef64f6e9eca21dbe4d2efdae1577f096a904

        • memory/2332-1-0x0000000000EF0000-0x0000000000EFE000-memory.dmp

          Filesize

          56KB

        • memory/2332-26-0x00007FFAC2430000-0x00007FFAC2EF1000-memory.dmp

          Filesize

          10.8MB

        • memory/2332-0-0x00007FFAC2433000-0x00007FFAC2435000-memory.dmp

          Filesize

          8KB

        • memory/2332-24-0x00007FFAC2430000-0x00007FFAC2EF1000-memory.dmp

          Filesize

          10.8MB

        • memory/3952-3-0x0000021E61300000-0x0000021E61301000-memory.dmp

          Filesize

          4KB

        • memory/3952-11-0x0000021E61300000-0x0000021E61301000-memory.dmp

          Filesize

          4KB

        • memory/3952-10-0x0000021E61300000-0x0000021E61301000-memory.dmp

          Filesize

          4KB

        • memory/3952-9-0x0000021E61300000-0x0000021E61301000-memory.dmp

          Filesize

          4KB

        • memory/3952-8-0x0000021E61300000-0x0000021E61301000-memory.dmp

          Filesize

          4KB

        • memory/3952-12-0x0000021E61300000-0x0000021E61301000-memory.dmp

          Filesize

          4KB

        • memory/3952-13-0x0000021E61300000-0x0000021E61301000-memory.dmp

          Filesize

          4KB

        • memory/3952-14-0x0000021E61300000-0x0000021E61301000-memory.dmp

          Filesize

          4KB

        • memory/3952-4-0x0000021E61300000-0x0000021E61301000-memory.dmp

          Filesize

          4KB

        • memory/3952-2-0x0000021E61300000-0x0000021E61301000-memory.dmp

          Filesize

          4KB