Analysis

  • max time kernel
    143s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09-11-2024 14:39

General

  • Target

    XClient.exe

  • Size

    76KB

  • MD5

    8807fa0a397ac570dd8b1d6bed1aadc5

  • SHA1

    27531764eb5629d02ef10ad25a89328daa442f5a

  • SHA256

    3465eee847488e3fd2f70bc78642ce8f82cbef40b95b5ac448901d9e13c07dbb

  • SHA512

    ebedb1bd4ee83d2e1f97868c0cd5574e34deb2e61db2ec01e3ae32f11e979504a527391fdd3dcad02f785a4ea7d87084b23f396316a06fda3e01f8f1341f790b

  • SSDEEP

    1536:eX3pX/Z0rG675wHvayJbtE+bC5v5tUfJ3X1QkOyog9B3Kqb8:eX3R/KrN74ayJa+bCVQRekOG9Baqb8

Malware Config

Extracted

Family

xworm

C2

192.168.29.241:22119

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 4 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1876
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Comet" /tr "C:\ProgramData\Comet"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2804
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {1B6B1CB7-1DD8-455D-B39B-E499ECB7B60E} S-1-5-21-3290804112-2823094203-3137964600-1000:VORHPBAB\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2580
    • C:\ProgramData\Comet
      C:\ProgramData\Comet
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3016
    • C:\ProgramData\Comet
      C:\ProgramData\Comet
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2532
    • C:\ProgramData\Comet
      C:\ProgramData\Comet
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2204

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Comet

    Filesize

    76KB

    MD5

    8807fa0a397ac570dd8b1d6bed1aadc5

    SHA1

    27531764eb5629d02ef10ad25a89328daa442f5a

    SHA256

    3465eee847488e3fd2f70bc78642ce8f82cbef40b95b5ac448901d9e13c07dbb

    SHA512

    ebedb1bd4ee83d2e1f97868c0cd5574e34deb2e61db2ec01e3ae32f11e979504a527391fdd3dcad02f785a4ea7d87084b23f396316a06fda3e01f8f1341f790b

  • memory/1876-0-0x000007FEF5753000-0x000007FEF5754000-memory.dmp

    Filesize

    4KB

  • memory/1876-1-0x0000000001340000-0x0000000001358000-memory.dmp

    Filesize

    96KB

  • memory/1876-5-0x000007FEF5750000-0x000007FEF613C000-memory.dmp

    Filesize

    9.9MB

  • memory/1876-6-0x000007FEF5753000-0x000007FEF5754000-memory.dmp

    Filesize

    4KB

  • memory/1876-11-0x000007FEF5750000-0x000007FEF613C000-memory.dmp

    Filesize

    9.9MB

  • memory/2204-15-0x0000000000300000-0x0000000000318000-memory.dmp

    Filesize

    96KB

  • memory/3016-10-0x0000000001390000-0x00000000013A8000-memory.dmp

    Filesize

    96KB