Analysis
-
max time kernel
237s -
max time network
239s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2024 14:06
Behavioral task
behavioral1
Sample
XClient.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
1200 seconds
General
-
Target
XClient.exe
-
Size
38KB
-
MD5
bfbb29d4f8dc3ce3b7b67e055fb70bcf
-
SHA1
f9a646e32fb5ec8eb10f1486e5a95883a902b108
-
SHA256
dd90b5843c6550de3403c5bf221c3639e56083e337f49050cd21c625229d9609
-
SHA512
e05e3db627c1a9d8de16f1357a95f330b71724dd8ae182a62ad0d3c55414d6ad0caa4ca28f0bb746173565cd1705aa82fa8d41cd99ddddbc43379a746f568a71
-
SSDEEP
768:siS8brf7blu3ml5G7m9NFfZk7FWPB9WxOOMhTaQkrl:zpnf7c+5PFyFO9WxOOM5sl
Malware Config
Extracted
Family
xworm
Version
5.0
C2
instruments-survivor.gl.at.ply.gg:29973
Mutex
Bv3T1nydYnsmIsFU
Attributes
-
Install_directory
%LocalAppData%
-
install_file
svchost.exe
aes.plain
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/3916-13-0x00000000016E0000-0x00000000016EE000-memory.dmp disable_win_def -
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral2/memory/3916-1-0x0000000000D60000-0x0000000000D70000-memory.dmp family_xworm behavioral2/files/0x000d000000023b59-28.dat family_xworm -
Xworm family
-
Disables Task Manager via registry modification
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation XClient.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk XClient.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk XClient.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: XClient.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Kills process with taskkill 2 IoCs
pid Process 2856 taskkill.exe 628 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings explorer.exe -
Suspicious behavior: EnumeratesProcesses 59 IoCs
pid Process 3916 XClient.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 3916 XClient.exe Token: SeDebugPrivilege 3916 XClient.exe Token: SeDebugPrivilege 3556 taskmgr.exe Token: SeSystemProfilePrivilege 3556 taskmgr.exe Token: SeCreateGlobalPrivilege 3556 taskmgr.exe Token: 33 2464 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2464 AUDIODG.EXE Token: SeDebugPrivilege 2856 taskkill.exe Token: SeDebugPrivilege 628 taskkill.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3916 XClient.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3916 XClient.exe 3556 taskmgr.exe 3916 XClient.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3916 XClient.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3916 XClient.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3916 wrote to memory of 4444 3916 XClient.exe 110 PID 3916 wrote to memory of 4444 3916 XClient.exe 110 PID 3916 wrote to memory of 628 3916 XClient.exe 111 PID 3916 wrote to memory of 628 3916 XClient.exe 111 PID 3916 wrote to memory of 2856 3916 XClient.exe 112 PID 3916 wrote to memory of 2856 3916 XClient.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Checks computer location settings
- Drops startup file
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Modifies registry class
PID:4444
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:628
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2856
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3556
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x338 0x4ac1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD5bfbb29d4f8dc3ce3b7b67e055fb70bcf
SHA1f9a646e32fb5ec8eb10f1486e5a95883a902b108
SHA256dd90b5843c6550de3403c5bf221c3639e56083e337f49050cd21c625229d9609
SHA512e05e3db627c1a9d8de16f1357a95f330b71724dd8ae182a62ad0d3c55414d6ad0caa4ca28f0bb746173565cd1705aa82fa8d41cd99ddddbc43379a746f568a71
-
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_22A5F8C01828487ABCE4EDB68CB80E54.dat
Filesize940B
MD5d6436729a5ee945f31db554a4e9562f7
SHA189555893e7aa7b7d9bf5e11433439699daa02d41
SHA25604ae74df299c1010bf86053e58637117f4c0d7c62c18d35f32d60148031ba2dd
SHA51215b2954cbbce9e66a45236cdd236d25c2524d886c93604abe824b03ad8c986cf5dbf255ec423e801b61df62f59b6cd47d366e5e744ca3f5f0d419b1b7c79a81c
-
Filesize
962B
MD5c68223afd7abe623bbf30563f7845e1e
SHA190ba3d761fa0f64e2b5b104fb53848184551e161
SHA256a311513c49172b0358c7db555fdd35680adc4039b2b98335e12cdf19dad4fc52
SHA5123b2d911b5c389883e8d76ff72d4aba4a76c3daf699789a047a2985e3451fea5372584a277a3d807215bbbf2ffb99555c001cb1d7e5ef126b2e8c39d2046f2e00