Analysis
-
max time kernel
51s -
max time network
41s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-11-2024 17:32
General
-
Target
XClient.exe
-
Size
33KB
-
MD5
33081cfb31f7e29654099d9569ee53b1
-
SHA1
fccf89fb8b1ab16a7e9132b65ea413d608f80a0a
-
SHA256
06c3272ba85c845b09075e1bb03de99667dbe3ddc8ca6c9aecc6a81cc405b782
-
SHA512
8689f476003b510f49bce7066f54c84752fa3c09ec5d94e57876dba92eeb3c70b78d7b97e1bf6baccf31ba22b2d1a4da6afe814ffd6af6bc0ddbac36bad1130f
-
SSDEEP
384:7fP/SG1aTTcPTEUV75LC2SM42pfL3iB7OxVqWqKRApkFXBLTsOZwpGN2v99Ikui1:711weF3X42JiB70lVF49jSOjhAb0p
Malware Config
Extracted
Family
xworm
Version
5.0
C2
127.0.0.1:7000
front-applications.gl.at.ply.gg:7000
Mutex
7LuKbjLL15rcFt9q
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/2372-1-0x0000000000B50000-0x0000000000B5E000-memory.dmp family_xworm -
Xworm family
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2372 XClient.exe Token: SeDebugPrivilege 1852 taskmgr.exe Token: SeSystemProfilePrivilege 1852 taskmgr.exe Token: SeCreateGlobalPrivilege 1852 taskmgr.exe -
Suspicious use of FindShellTrayWindow 48 IoCs
pid Process 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2372
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1852