Overview

overview

10

Static

static

10

XClient.exe

windows7-x64

10

XClient.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    20-11-2024 16:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    XClient.exe

  • Size

    41KB

  • MD5

    486527e2986049735316f190c8571c72

  • SHA1

    9ce5e9ae89d3b91c834ac66d5ab947687b867c19

  • SHA256

    c150b18ea2bd00902f2b8de9b0439ef6bd2a448b3255ac4619bab7de57407ea3

  • SHA512

    01ed720a7100238bb51e1fa6ebe88e62a3fa6c3060c472891c38b0cfc17e29d4f11899a0dd12d3460473f751af299a5e5c87e97a2a75b0c7e911b5797f13c745

  • SSDEEP

    768:bG2ZOWZ42nxuT3XvgggCLJF5PG9pmWJ6vOwhX3Emz9:bG2bZ42n07XvvgcFI9AWJ6vOwV9Z

Score
10/10
xwormexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

ikonik2681-35277.portmap.host:35277

Mutex

NwRz6E7beRbMfRwa

Attributes
  • Install_directory

    %AppData%

  • install_file

    $77MicrosoftDefender.exe

aes.plain

Signatures

  • Detect Xworm Payload 5 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2304
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2772
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2900
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77MicrosoftDefender.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2836
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77MicrosoftDefender.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:436
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "$77MicrosoftDefender" /tr "C:\Users\Admin\AppData\Roaming\$77MicrosoftDefender.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:1040
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {E7398B7A-8FA8-4D22-8B2F-C6BE6D39D042} S-1-5-21-3692679935-4019334568-335155002-1000:BCXRJFKE\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1996
    • C:\Users\Admin\AppData\Roaming\$77MicrosoftDefender.exe
      C:\Users\Admin\AppData\Roaming\$77MicrosoftDefender.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1904
    • C:\Users\Admin\AppData\Roaming\$77MicrosoftDefender.exe
      C:\Users\Admin\AppData\Roaming\$77MicrosoftDefender.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1712
    • C:\Users\Admin\AppData\Roaming\$77MicrosoftDefender.exe
      C:\Users\Admin\AppData\Roaming\$77MicrosoftDefender.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2124

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\$77MicrosoftDefender.exe
    Filesize

    41KB

    MD5

    486527e2986049735316f190c8571c72

    SHA1

    9ce5e9ae89d3b91c834ac66d5ab947687b867c19

    SHA256

    c150b18ea2bd00902f2b8de9b0439ef6bd2a448b3255ac4619bab7de57407ea3

    SHA512

    01ed720a7100238bb51e1fa6ebe88e62a3fa6c3060c472891c38b0cfc17e29d4f11899a0dd12d3460473f751af299a5e5c87e97a2a75b0c7e911b5797f13c745

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
    Filesize

    7KB

    MD5

    dae0905a074147bd86d094f454832e64

    SHA1

    85ea969d56b0d206b207eacf23a68df75c4f5cea

    SHA256

    569d0236e7cd4adc3f5a3cf124f687621f6ba8203188504c1c196ba950eded59

    SHA512

    b3e19384bdcceee355303974902a57f5e42202899f8df84bdb77e5c7df9cb90917fae44f3c2a7c71fe4eae8c3b22bcd5aedfa6e2129e0d2c42e689cc3c15c1b3

    Download Submit

  • memory/1712-39-0x0000000001130000-0x0000000001140000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1904-36-0x00000000000F0000-0x0000000000100000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2124-41-0x00000000011E0000-0x00000000011F0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2304-1-0x00000000012C0000-0x00000000012D0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2304-2-0x000007FEF5A90000-0x000007FEF647C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2304-0-0x000007FEF5A93000-0x000007FEF5A94000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2304-16-0x000007FEF5A93000-0x000007FEF5A94000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2304-32-0x000007FEF5A90000-0x000007FEF647C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2772-7-0x000000001B190000-0x000000001B472000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/2772-8-0x0000000002410000-0x0000000002418000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2900-14-0x000000001B350000-0x000000001B632000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/2900-15-0x0000000002230000-0x0000000002238000-memory.dmp

    Filesize

    32KB

    Download