Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13-11-2024 18:31
Static task
static1
Behavioral task
behavioral1
Sample
97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe
Resource
win7-20240903-en
General
-
Target
97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe
-
Size
653KB
-
MD5
2f70673f42fa875f6086be3f08d0228d
-
SHA1
9d669bedf14a71f846ffa4fd2026f8d956daa57e
-
SHA256
97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64
-
SHA512
3dfe6da9f87e82f59addc56aaad56f25305aa2f1ea4a579b9829dd4fffa4f89a93d74f5311e4194bf4c42b035394cf2e3fd5480b0237d24076c33c60603b9dc6
-
SSDEEP
12288:8qFKqcoUvEmbGqbxoVOxEKEXQ8MUzNkFa21YQ1G8aJqjZ0uqISt:8q0qconmNKYq5zZNkk2qQ8jJq10uqIg
Malware Config
Extracted
xworm
5.0
154.216.20.132:2233
NFxnDoJ61PAf6tB3
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 5 IoCs
resource yara_rule behavioral1/memory/2660-18-0x0000000000400000-0x0000000000410000-memory.dmp family_xworm behavioral1/memory/2660-25-0x0000000000400000-0x0000000000410000-memory.dmp family_xworm behavioral1/memory/2660-24-0x0000000000400000-0x0000000000410000-memory.dmp family_xworm behavioral1/memory/2660-23-0x0000000000400000-0x0000000000410000-memory.dmp family_xworm behavioral1/memory/2660-20-0x0000000000400000-0x0000000000410000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2560 powershell.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk 97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk 97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe -
Loads dropped DLL 1 IoCs
pid Process 2660 97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 816 set thread context of 2660 816 97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe 35 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2808 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2560 powershell.exe 2660 97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2660 97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe Token: SeDebugPrivilege 2560 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2660 97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 816 wrote to memory of 2560 816 97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe 31 PID 816 wrote to memory of 2560 816 97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe 31 PID 816 wrote to memory of 2560 816 97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe 31 PID 816 wrote to memory of 2560 816 97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe 31 PID 816 wrote to memory of 2808 816 97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe 33 PID 816 wrote to memory of 2808 816 97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe 33 PID 816 wrote to memory of 2808 816 97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe 33 PID 816 wrote to memory of 2808 816 97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe 33 PID 816 wrote to memory of 2660 816 97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe 35 PID 816 wrote to memory of 2660 816 97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe 35 PID 816 wrote to memory of 2660 816 97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe 35 PID 816 wrote to memory of 2660 816 97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe 35 PID 816 wrote to memory of 2660 816 97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe 35 PID 816 wrote to memory of 2660 816 97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe 35 PID 816 wrote to memory of 2660 816 97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe 35 PID 816 wrote to memory of 2660 816 97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe 35 PID 816 wrote to memory of 2660 816 97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe"C:\Users\Admin\AppData\Local\Temp\97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\FFXkKmgOJiIrD.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2560
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FFXkKmgOJiIrD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4E6E.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2808
-
-
C:\Users\Admin\AppData\Local\Temp\97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe"C:\Users\Admin\AppData\Local\Temp\97ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64.exe"2⤵
- Drops startup file
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2660
-
Network
- No results found
-
152 B 120 B 3 3
-
152 B 120 B 3 3
-
152 B 120 B 3 3
-
152 B 120 B 3 3
-
152 B 80 B 3 2
-
152 B 120 B 3 3
-
152 B 120 B 3 3
-
152 B 120 B 3 3
-
152 B 120 B 3 3
-
152 B 120 B 3 3
-
152 B 120 B 3 3
-
152 B 120 B 3 3
-
152 B 120 B 3 3
-
152 B 120 B 3 3
-
152 B 120 B 3 3
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5f6c5634ca994e256074e32002dad8108
SHA1c5c8ca019d169f7e98c5b9886780521652175002
SHA256bf7f7e803a8fc2e706a8f697ade6f341a5a985ed35e895435bcd81338d98d2cd
SHA5129983a585f2d9bce71abf7eee62607c4f9fcde9faf099fc7e5f1e5248b492f4aae3a612734c88152bfbdd80596a6d275df8739547befce2cb119e74ae37796a02
-
Filesize
653KB
MD52f70673f42fa875f6086be3f08d0228d
SHA19d669bedf14a71f846ffa4fd2026f8d956daa57e
SHA25697ef8e5f7cce1ba7216aae7b44778fee1140371a68681b84b886bfbffb1e9e64
SHA5123dfe6da9f87e82f59addc56aaad56f25305aa2f1ea4a579b9829dd4fffa4f89a93d74f5311e4194bf4c42b035394cf2e3fd5480b0237d24076c33c60603b9dc6