Analysis
-
max time kernel
135s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04-11-2024 14:58
Behavioral task
behavioral1
Sample
client.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
1800 seconds
Behavioral task
behavioral2
Sample
client.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
1800 seconds
Behavioral task
behavioral3
Sample
client.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
1800 seconds
Behavioral task
behavioral4
Sample
client.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
5 signatures
1800 seconds
General
-
Target
client.exe
-
Size
70KB
-
MD5
494a6deacff35b09fa7ef63172461c77
-
SHA1
3ca3994099d3a0b759141fc389fbc2d2b2198c04
-
SHA256
72f447c5e862b675b8f24692a565820845cdbc7ea563a61e650399ffe5bf7dc4
-
SHA512
03f03dda2a270292c5420a4e074ac73e53db8fbb8ea2d25d71613f0400c994e258965b89a646d9e1572bcb149ae3582a016655bc0c8aa3429581285a2a2448ae
-
SSDEEP
1536:09Y24D0WTmIJz9WeF/IWqqEbbTOtsfl8dKLkefdVMC+zOQyPnMFCX:0zITmheRIWqLbssfMKdd+zO7P6C
Malware Config
Extracted
Family
xworm
C2
thus-dh.gl.at.ply.gg:40949
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/1560-1-0x00000000001C0000-0x00000000001D8000-memory.dmp family_xworm -
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 21 ip-api.com -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3408 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1560 client.exe Token: SeDebugPrivilege 3408 taskmgr.exe Token: SeSystemProfilePrivilege 3408 taskmgr.exe Token: SeCreateGlobalPrivilege 3408 taskmgr.exe Token: 33 3408 taskmgr.exe Token: SeIncBasePriorityPrivilege 3408 taskmgr.exe -
Suspicious use of FindShellTrayWindow 40 IoCs
pid Process 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe -
Suspicious use of SendNotifyMessage 40 IoCs
pid Process 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe 3408 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\client.exe"C:\Users\Admin\AppData\Local\Temp\client.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1560
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3408