Resubmissions
01/12/2024, 20:51
241201-znngha1pew1015/11/2024, 18:53
241115-xjnklazdqp15/11/2024, 18:52
241115-xh927synds1015/11/2024, 18:49
241115-xgp1mstkaj1015/11/2024, 18:48
241115-xfqwjstjgp1015/11/2024, 18:45
241115-xd4pmazdkq1015/11/2024, 16:38
241115-t5f6vsxfjd10Analysis
- max time kernel
97s - max time network
149s - platform
windows10-ltsc 2021_x64 - resource
win10ltsc2021-20241023-en - resource tags
- submitted
15/11/2024, 18:45
General
- Target XClient.exe
- Size 63KB
- Sample241115-xd4pmazdkq
- SHA256 c82bb2bdf2a6a156eaa280eb6cd7f006e5c2421a24490ea017e0048c5e4ab140
Score
10/10
Malware Config
Extracted
Family
-
xworm
C2
-
127.0.0.1:56069
-
front-applications.gl.at.ply.gg:56069
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Drops startup file 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1776-0-0x00007FFE060D3000-0x00007FFE060D5000-memory.dmp
memory/1776-1-0x00000000007D0000-0x00000000007E6000-memory.dmp
memory/1776-6-0x00007FFE060D0000-0x00007FFE06B92000-memory.dmp
memory/1776-7-0x00007FFE060D3000-0x00007FFE060D5000-memory.dmp
memory/1776-8-0x00007FFE060D0000-0x00007FFE06B92000-memory.dmp
memory/1776-9-0x000000001B440000-0x000000001B44A000-memory.dmp