Analysis
- max time kernel
237s - max time network
239s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
13/11/2024, 14:06
Behavioral task
behavioral1
Sample
XClient.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
1200 seconds
General
- Target XClient.exe
- Size 38KB
- Sample241113-reg95aspaw
- SHA256 dd90b5843c6550de3403c5bf221c3639e56083e337f49050cd21c625229d9609
- MD5 bfbb29d4f8dc3ce3b7b67e055fb70bcf
- SHA1 f9a646e32fb5ec8eb10f1486e5a95883a902b108
- SHA512 e05e3db627c1a9d8de16f1357a95f330b71724dd8ae182a62ad0d3c55414d6ad0caa4ca28f0bb746173565cd1705aa82fa8d41cd99ddddbc43379a746f568a71
- SSDEEP 768:siS8brf7blu3ml5G7m9NFfZk7FWPB9WxOOMhTaQkrl:zpnf7c+5PFyFO9WxOOM5sl
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
xworm
Version
-
5.0
C2
-
instruments-survivor.gl.at.ply.gg:29973
Mutex
-
Bv3T1nydYnsmIsFU
Attributes
-
Install_directory
%LocalAppData%
-
install_file
svchost.exe
aes.plain
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/3916-13-0x00000000016E0000-0x00000000016EE000-memory.dmp disable_win_def - Detect Xworm Payload 2 IoCs
resource yara_rule behavioral2/memory/3916-1-0x0000000000D60000-0x0000000000D70000-memory.dmp family_xworm behavioral2/files/0x000d000000023b59-28.dat family_xworm - Xworm family
- Disables Task Manager via registry modification
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation XClient.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk XClient.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk XClient.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: XClient.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Kills process with taskkill 2 IoCs
pid Process 2856 taskkill.exe 628 taskkill.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings explorer.exe - Suspicious behavior: EnumeratesProcesses 59 IoCs
pid Process 3916 XClient.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 3916 XClient.exe Token: SeDebugPrivilege 3916 XClient.exe Token: SeDebugPrivilege 3556 taskmgr.exe Token: SeSystemProfilePrivilege 3556 taskmgr.exe Token: SeCreateGlobalPrivilege 3556 taskmgr.exe Token: 33 2464 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2464 AUDIODG.EXE Token: SeDebugPrivilege 2856 taskkill.exe Token: SeDebugPrivilege 628 taskkill.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3916 XClient.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3916 XClient.exe 3556 taskmgr.exe 3916 XClient.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3916 XClient.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3916 XClient.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3916 wrote to memory of 4444 3916 XClient.exe 110 PID 3916 wrote to memory of 4444 3916 XClient.exe 110 PID 3916 wrote to memory of 628 3916 XClient.exe 111 PID 3916 wrote to memory of 628 3916 XClient.exe 111 PID 3916 wrote to memory of 2856 3916 XClient.exe 112 PID 3916 wrote to memory of 2856 3916 XClient.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Checks computer location settings
- Drops startup file
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Modifies registry class
PID:4444
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:628
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2856
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3556
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x338 0x4ac1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\svchost.exe
- Size 38KB
- SHA256 dd90b5843c6550de3403c5bf221c3639e56083e337f49050cd21c625229d9609
- MD5 bfbb29d4f8dc3ce3b7b67e055fb70bcf
- SHA1 f9a646e32fb5ec8eb10f1486e5a95883a902b108
- SHA512 e05e3db627c1a9d8de16f1357a95f330b71724dd8ae182a62ad0d3c55414d6ad0caa4ca28f0bb746173565cd1705aa82fa8d41cd99ddddbc43379a746f568a71
- SSDEEP 768:siS8brf7blu3ml5G7m9NFfZk7FWPB9WxOOMhTaQkrl:zpnf7c+5PFyFO9WxOOM5sl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_22A5F8C01828487ABCE4EDB68CB80E54.dat
- Size 940B
- SHA256 04ae74df299c1010bf86053e58637117f4c0d7c62c18d35f32d60148031ba2dd
- MD5 d6436729a5ee945f31db554a4e9562f7
- SHA1 89555893e7aa7b7d9bf5e11433439699daa02d41
- SHA512 15b2954cbbce9e66a45236cdd236d25c2524d886c93604abe824b03ad8c986cf5dbf255ec423e801b61df62f59b6cd47d366e5e744ca3f5f0d419b1b7c79a81c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk
- Size 962B
- SHA256 a311513c49172b0358c7db555fdd35680adc4039b2b98335e12cdf19dad4fc52
- MD5 c68223afd7abe623bbf30563f7845e1e
- SHA1 90ba3d761fa0f64e2b5b104fb53848184551e161
- SHA512 3b2d911b5c389883e8d76ff72d4aba4a76c3daf699789a047a2985e3451fea5372584a277a3d807215bbbf2ffb99555c001cb1d7e5ef126b2e8c39d2046f2e00
- MD5 SHA1 SHA512