Analysis
-
max time kernel
599s -
max time network
596s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11-11-2024 22:59
Behavioral task
behavioral1
Sample
XClient.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
600 seconds
General
-
Target
XClient.exe
-
Size
38KB
-
MD5
ae50a76a857b87ec226760a04008e520
-
SHA1
209202d2d9f1e844df41680fcdbb696f42bb6569
-
SHA256
d42d5474c1744aed95113691b98d149890d3ec920c8f19dcca2edc5fa6a85c99
-
SHA512
f7c5f95966d945496b1b65c29a8301f75917419879da2bfe1f389d800b903d559d2da93f4d4b5ffc7990e3b85f0bb30c8c61a7bf04c7ad22a1a4ebba62b36d83
-
SSDEEP
768:8zzEorBoNsGxE35G7nSthO/i7FWP59WthOMhTaQki:2AorBgxy5XqiFK9WthOM1v
Malware Config
Extracted
Family
xworm
Version
5.0
C2
147.185.221.23:35660
Mutex
u6ggE01EpUtTQVJC
Attributes
-
Install_directory
%Userprofile%
-
install_file
svchost.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/2532-1-0x00000000011A0000-0x00000000011B0000-memory.dmp family_xworm -
Xworm family
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk XClient.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk XClient.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2532 XClient.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2316 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2532 XClient.exe Token: SeDebugPrivilege 2532 XClient.exe Token: SeDebugPrivilege 2316 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2532 XClient.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2532
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2316