xworm | 16b9779bc79413bbfa3194a7cf406635548c03b4f7ebdce230aa88dc6bf01da0

General

Target

FULLOPTION.exe
Size

4.7MB
MD5

9907f1198b7ef415b03810f28cd1b32f
SHA1

df6773b58ddd0de1bad25ce141431b1805011ea9
SHA256

16b9779bc79413bbfa3194a7cf406635548c03b4f7ebdce230aa88dc6bf01da0
SHA512

4dd1af5964cbc6fd3c3f1b4ee3809d4286d193e9f3839599ccb718aad150d460fbeffa592e3d5b6d45c717c5328dd48853e7fdbcc4e8e7613a8799d05f20b474
SSDEEP

98304:CS183Lm2l1laOmBSHmhRMI7f/1Z6p81tznH3AHI2O9eoSSM:CS183Lm2l1laOm7zdqCtzH3YXo

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

45.141.27.222:5000

127.0.0.1:7000

Attributes

Install_directory
%AppData%
install_file
Updete.exe

Signatures

Detect Xworm Payload 8 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2708-14-0x00000000003A0000-0x00000000003B8000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Roaming\svchot.exe	family_xworm
C:\Users\Admin\AppData\Roaming\Steam.exe	family_xworm
C:\Users\Admin\AppData\Roaming\microsoft.exe	family_xworm
C:\Users\Admin\AppData\Roaming\XClient.exe	family_xworm
behavioral1/memory/336-27-0x0000000000940000-0x0000000000968000-memory.dmp	family_xworm
behavioral1/memory/2240-30-0x0000000000220000-0x0000000000238000-memory.dmp	family_xworm
behavioral1/memory/1868-29-0x0000000001360000-0x00000000013BA000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
1204	powershell.exe
1896	powershell.exe
1968	powershell.exe
2160	powershell.exe
1416	powershell.exe
1640	powershell.exe
2780	powershell.exe
2868	powershell.exe
3056	powershell.exe
1700	powershell.exe
1512	powershell.exe
540	powershell.exe
1536	powershell.exe
1820	powershell.exe

Executes dropped EXE 5 IoCs

Processes:

FULLOPTION.exesvchot.exeSteam.exemicrosoft.exeXClient.exe

pid process

2244 FULLOPTION.exe
2708 svchot.exe
1868 Steam.exe
336 microsoft.exe
2240 XClient.exe
Loads dropped DLL 1 IoCs

Processes:

FULLOPTION.exe

pid process

2540 FULLOPTION.exe

pid	process
2244	FULLOPTION.exe
2708	svchot.exe
1868	Steam.exe
336	microsoft.exe
2240	XClient.exe

pid	process
2540	FULLOPTION.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchot.exeSteam.exemicrosoft.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Updete = "C:\\Users\\Admin\\AppData\\Roaming\\Updete.exe"	svchot.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Updete = "C:\\Users\\Admin\\AppData\\Roaming\\Updete.exe"	Steam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Updete = "C:\\Users\\Admin\\AppData\\Roaming\\Updete.exe"	microsoft.exe

Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 ip-api.com
9 ip-api.com
10 ip-api.com
7 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
8	ip-api.com
9	ip-api.com
10	ip-api.com
7	ip-api.com

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeXClient.exepowershell.exepowershell.exepowershell.exesvchot.exeSteam.exemicrosoft.exetaskmgr.exe

pid	process
3056	powershell.exe
1700	powershell.exe
1968	powershell.exe
2160	powershell.exe
1204	powershell.exe
1536	powershell.exe
1820	powershell.exe
1512	powershell.exe
1896	powershell.exe
1416	powershell.exe
1640	powershell.exe
2240	XClient.exe
2868	powershell.exe
2780	powershell.exe
540	powershell.exe
2708	svchot.exe
1868	Steam.exe
336	microsoft.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

taskmgr.exe

pid process

2192 taskmgr.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

svchot.exemicrosoft.exeSteam.exeXClient.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exetaskmgr.exe

description	pid	process
Token: SeDebugPrivilege	2708	svchot.exe
Token: SeDebugPrivilege	336	microsoft.exe
Token: SeDebugPrivilege	1868	Steam.exe
Token: SeDebugPrivilege	2240	XClient.exe
Token: SeDebugPrivilege	3056	powershell.exe
Token: SeDebugPrivilege	1700	powershell.exe
Token: SeDebugPrivilege	1968	powershell.exe
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeDebugPrivilege	1204	powershell.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeDebugPrivilege	1820	powershell.exe
Token: SeDebugPrivilege	1512	powershell.exe
Token: SeDebugPrivilege	1896	powershell.exe
Token: SeDebugPrivilege	1416	powershell.exe
Token: SeDebugPrivilege	1640	powershell.exe
Token: SeDebugPrivilege	2868	powershell.exe
Token: SeDebugPrivilege	2240	XClient.exe
Token: SeDebugPrivilege	2780	powershell.exe
Token: SeDebugPrivilege	540	powershell.exe
Token: SeDebugPrivilege	2708	svchot.exe
Token: SeDebugPrivilege	1868	Steam.exe
Token: SeDebugPrivilege	336	microsoft.exe
Token: SeDebugPrivilege	2192	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

taskmgr.exe

pid	process
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exe

pid	process
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe
2192	taskmgr.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

XClient.exesvchot.exeSteam.exemicrosoft.exe

pid process

2240 XClient.exe
2708 svchot.exe
1868 Steam.exe
336 microsoft.exe

pid	process
2240	XClient.exe
2708	svchot.exe
1868	Steam.exe
336	microsoft.exe

Suspicious use of WriteProcessMemory 57 IoCs

Processes:

FULLOPTION.exeXClient.exesvchot.exeSteam.exemicrosoft.exe

description	pid	process	target process
PID 2540 wrote to memory of 2244	2540	FULLOPTION.exe	FULLOPTION.exe
PID 2540 wrote to memory of 2244	2540	FULLOPTION.exe	FULLOPTION.exe
PID 2540 wrote to memory of 2244	2540	FULLOPTION.exe	FULLOPTION.exe
PID 2540 wrote to memory of 2708	2540	FULLOPTION.exe	svchot.exe
PID 2540 wrote to memory of 2708	2540	FULLOPTION.exe	svchot.exe
PID 2540 wrote to memory of 2708	2540	FULLOPTION.exe	svchot.exe
PID 2540 wrote to memory of 1868	2540	FULLOPTION.exe	Steam.exe
PID 2540 wrote to memory of 1868	2540	FULLOPTION.exe	Steam.exe
PID 2540 wrote to memory of 1868	2540	FULLOPTION.exe	Steam.exe
PID 2540 wrote to memory of 336	2540	FULLOPTION.exe	microsoft.exe
PID 2540 wrote to memory of 336	2540	FULLOPTION.exe	microsoft.exe
PID 2540 wrote to memory of 336	2540	FULLOPTION.exe	microsoft.exe
PID 2540 wrote to memory of 2240	2540	FULLOPTION.exe	XClient.exe
PID 2540 wrote to memory of 2240	2540	FULLOPTION.exe	XClient.exe
PID 2540 wrote to memory of 2240	2540	FULLOPTION.exe	XClient.exe
PID 2240 wrote to memory of 3056	2240	XClient.exe	powershell.exe
PID 2240 wrote to memory of 3056	2240	XClient.exe	powershell.exe
PID 2240 wrote to memory of 3056	2240	XClient.exe	powershell.exe
PID 2708 wrote to memory of 1700	2708	svchot.exe	powershell.exe
PID 2708 wrote to memory of 1700	2708	svchot.exe	powershell.exe
PID 2708 wrote to memory of 1700	2708	svchot.exe	powershell.exe
PID 1868 wrote to memory of 1968	1868	Steam.exe	powershell.exe
PID 1868 wrote to memory of 1968	1868	Steam.exe	powershell.exe
PID 1868 wrote to memory of 1968	1868	Steam.exe	powershell.exe
PID 336 wrote to memory of 2160	336	microsoft.exe	powershell.exe
PID 336 wrote to memory of 2160	336	microsoft.exe	powershell.exe
PID 336 wrote to memory of 2160	336	microsoft.exe	powershell.exe
PID 1868 wrote to memory of 1204	1868	Steam.exe	powershell.exe
PID 1868 wrote to memory of 1204	1868	Steam.exe	powershell.exe
PID 1868 wrote to memory of 1204	1868	Steam.exe	powershell.exe
PID 336 wrote to memory of 1536	336	microsoft.exe	powershell.exe
PID 336 wrote to memory of 1536	336	microsoft.exe	powershell.exe
PID 336 wrote to memory of 1536	336	microsoft.exe	powershell.exe
PID 2708 wrote to memory of 1820	2708	svchot.exe	powershell.exe
PID 2708 wrote to memory of 1820	2708	svchot.exe	powershell.exe
PID 2708 wrote to memory of 1820	2708	svchot.exe	powershell.exe
PID 2240 wrote to memory of 1512	2240	XClient.exe	powershell.exe
PID 2240 wrote to memory of 1512	2240	XClient.exe	powershell.exe
PID 2240 wrote to memory of 1512	2240	XClient.exe	powershell.exe
PID 336 wrote to memory of 1416	336	microsoft.exe	powershell.exe
PID 336 wrote to memory of 1416	336	microsoft.exe	powershell.exe
PID 336 wrote to memory of 1416	336	microsoft.exe	powershell.exe
PID 1868 wrote to memory of 1896	1868	Steam.exe	powershell.exe
PID 1868 wrote to memory of 1896	1868	Steam.exe	powershell.exe
PID 1868 wrote to memory of 1896	1868	Steam.exe	powershell.exe
PID 2708 wrote to memory of 1640	2708	svchot.exe	powershell.exe
PID 2708 wrote to memory of 1640	2708	svchot.exe	powershell.exe
PID 2708 wrote to memory of 1640	2708	svchot.exe	powershell.exe
PID 1868 wrote to memory of 2868	1868	Steam.exe	powershell.exe
PID 1868 wrote to memory of 2868	1868	Steam.exe	powershell.exe
PID 1868 wrote to memory of 2868	1868	Steam.exe	powershell.exe
PID 2708 wrote to memory of 2780	2708	svchot.exe	powershell.exe
PID 2708 wrote to memory of 2780	2708	svchot.exe	powershell.exe
PID 2708 wrote to memory of 2780	2708	svchot.exe	powershell.exe
PID 336 wrote to memory of 540	336	microsoft.exe	powershell.exe
PID 336 wrote to memory of 540	336	microsoft.exe	powershell.exe
PID 336 wrote to memory of 540	336	microsoft.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\FULLOPTION.exe
"C:\Users\Admin\AppData\Local\Temp\FULLOPTION.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Users\Admin\AppData\Roaming\FULLOPTION.exe
  "C:\Users\Admin\AppData\Roaming\FULLOPTION.exe"
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Users\Admin\AppData\Roaming\svchot.exe
  "C:\Users\Admin\AppData\Roaming\svchot.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchot.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchot.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Updete.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1640
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Updete.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2780
- C:\Users\Admin\AppData\Roaming\Steam.exe
  "C:\Users\Admin\AppData\Roaming\Steam.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Steam.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Steam.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Updete.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Updete.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2868
- C:\Users\Admin\AppData\Roaming\microsoft.exe
  "C:\Users\Admin\AppData\Roaming\microsoft.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\microsoft.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2160
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'microsoft.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Updete.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Updete.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:540
- C:\Users\Admin\AppData\Roaming\XClient.exe
  "C:\Users\Admin\AppData\Roaming\XClient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1512

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
204cd0db85f87c6ae75e47c9bfb173ac

SHA1
1ad91c7ed931065896e1ef2c1caf8246568e5426

SHA256
f21fadb9a46e887ed7e440ca51fc1644d1665e5b886c9c3897ec9188f533ecd5

SHA512
f0c6fd16531bbc987964b5d79716c263f61edaa99f9fd68951d3416b5349745708fc7391a2db25b0a165f17b61a09067fa01a9337bfd074b41dfc0e7c82466a6

Download Submit
C:\Users\Admin\AppData\Roaming\Steam.exe

Filesize
334KB

MD5
ceee3ecf024a112ccf7961913269e427

SHA1
00841649617162fb1e3304a5c6bc762112c7028d

SHA256
2e255762f2d6e14d0f6ef93236162c4534ff47982ed21fe99bf6bee825916a47

SHA512
764f4c1e4b5c1a91d6256c2ef23559e8387b0d90360a902ff0a7cb31f2a4031d348f3b9648e1e50b9608be6eab7dfec5bfc928373e66682faf37ffd57db630f7

Download Submit
C:\Users\Admin\AppData\Roaming\XClient.exe

Filesize
69KB

MD5
28aa93aefb55bdcd6e10d47b0cf4b2ff

SHA1
81d9c21e1805ac54f193c3e4003a185c4284101c

SHA256
c5096e65190e515dfd7b967d3c06688d245302947f70be95275f35a9be11232f

SHA512
301af3bce98c32db8444cde3876a47f86dac119d814ff4b2b1a6f2bd5952c568343af5ec4bf104d9983f4992c33f57ee566d81ad4c7b3317b5f4a478e732c1f7

Download Submit
C:\Users\Admin\AppData\Roaming\microsoft.exe

Filesize
134KB

MD5
35ca2bf30d29985371c77c07021e285b

SHA1
306022fe7d67cca4d750498955ba7d2d5150c1cb

SHA256
93b744a61c81e0590a26abb9a47d3fec6b50f5f6216f20addcbed0359b875c09

SHA512
abd65455ae801ff4e6c03196142676faf1dcf58e9b20b24f2c701542aba1d13914a44009da53913234e2784cb2b912ee1fa2a952e0057b2cd3432e8b2253c927

Download Submit
C:\Users\Admin\AppData\Roaming\svchot.exe

Filesize
72KB

MD5
72e2cdeaa842da4806f61f23400fd44d

SHA1
319c3b0e92f9ef6f1b6f2067ed4779a15d9b07a9

SHA256
884fc2ad543fa83521c479d97d8c3a61c4fea9d2e856f4e7525aaad2c544c6dd

SHA512
cf81797b53aca5c56724b1c171968421e5d327e6af776c8f09f1966f8073e80e018e689bba8aa090b3a92db644d2fed5861512135962ddcadd64ce9a44e70d7d

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Roaming\FULLOPTION.exe

Filesize
3.8MB

MD5
1dcdd77ba8afe481b4af754876f70ee8

SHA1
322ac691dc8b990ccb94f66f43a1b98f4d1eb299

SHA256
e5f2c31e3b741665821670118a78692cd1f44a349ad20007c0628fa3fb307734

SHA512
ee67e29bfd257329a29a07bfdb629acecec718a9afb62fe87d3a4ff08074dad6176cc65eef15dece4b11c0f1e61df11912faa0da9f88b36c59bdbfc4d50bf1e3

Download Submit
memory/336-27-0x0000000000940000-0x0000000000968000-memory.dmp

Filesize
160KB

Download
memory/1700-41-0x000000001B770000-0x000000001BA52000-memory.dmp

Filesize
2.9MB

Download
memory/1868-29-0x0000000001360000-0x00000000013BA000-memory.dmp

Filesize
360KB

Download
memory/2192-112-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2192-114-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2192-113-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2240-30-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/2540-1-0x0000000001210000-0x00000000016BE000-memory.dmp

Filesize
4.7MB

Download
memory/2540-0-0x000007FEF61C3000-0x000007FEF61C4000-memory.dmp

Filesize
4KB

Download
memory/2708-111-0x000007FEF61C0000-0x000007FEF6BAC000-memory.dmp

Filesize
9.9MB

Download
memory/2708-14-0x00000000003A0000-0x00000000003B8000-memory.dmp

Filesize
96KB

Download
memory/2708-31-0x000007FEF61C0000-0x000007FEF6BAC000-memory.dmp

Filesize
9.9MB

Download
memory/2868-95-0x000000001B620000-0x000000001B902000-memory.dmp

Filesize
2.9MB

Download
memory/2868-96-0x00000000027D0000-0x00000000027D8000-memory.dmp

Filesize
32KB

Download
memory/3056-43-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads