Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
28/11/2024, 23:00
General
- Target SKM_BH450i2411261138090453854974574748668683985857435.scr.exe
- Size 545KB
- Sample241128-2yy24azker
- SHA256 2f8b625544a974b1d801bc2de338dca23abb89fd6d49b5b9bb8ad2dbbb7e41ba
Malware Config
Extracted
-
xworm
-
104.250.180.178:7061
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SKM_BH450i2411261138090453854974574748668683985857435.scr.exe"C:\Users\Admin\AppData\Local\Temp\SKM_BH450i2411261138090453854974574748668683985857435.scr.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SKM_BH450i2411261138090453854974574748668683985857435.scr.exe"C:\Users\Admin\AppData\Local\Temp\SKM_BH450i2411261138090453854974574748668683985857435.scr.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SKM_BH450i2411261138090453854974574748668683985857435.scr.exe"C:\Users\Admin\AppData\Local\Temp\SKM_BH450i2411261138090453854974574748668683985857435.scr.exe"2⤵
- Checks computer location settings
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SKM_BH450i2411261138090453854974574748668683985857435.scr.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SKM_BH450i2411261138090453854974574748668683985857435.scr.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
SKM_BH450i2411261138090453854974574748668683985857435.scr.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_cowqb0b5.yck.ps1
memory/1940-113-0x0000000006560000-0x00000000068B4000-memory.dmp
memory/1940-115-0x0000000070010000-0x000000007005C000-memory.dmp
memory/1944-14-0x00000000749C0000-0x0000000075170000-memory.dmp
memory/1944-59-0x00000000749C0000-0x0000000075170000-memory.dmp
memory/1944-11-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1944-130-0x00000000749C0000-0x0000000075170000-memory.dmp
memory/1944-131-0x00000000749C0000-0x0000000075170000-memory.dmp
memory/2232-71-0x0000000070010000-0x000000007005C000-memory.dmp
memory/3096-7-0x0000000005260000-0x0000000005278000-memory.dmp
memory/3096-4-0x0000000004D30000-0x0000000004D3A000-memory.dmp
memory/3096-8-0x00000000749CE000-0x00000000749CF000-memory.dmp
memory/3096-9-0x00000000749C0000-0x0000000075170000-memory.dmp
memory/3096-6-0x00000000749C0000-0x0000000075170000-memory.dmp
memory/3096-5-0x0000000004EE0000-0x0000000004F7C000-memory.dmp
memory/3096-1-0x0000000000240000-0x00000000002CE000-memory.dmp
memory/3096-15-0x00000000749C0000-0x0000000075170000-memory.dmp
memory/3096-3-0x0000000004C70000-0x0000000004D02000-memory.dmp
memory/3096-2-0x00000000052E0000-0x0000000005884000-memory.dmp
memory/3096-0-0x00000000749CE000-0x00000000749CF000-memory.dmp
memory/3096-10-0x0000000007E10000-0x0000000007E6A000-memory.dmp
memory/3492-87-0x0000000006170000-0x00000000064C4000-memory.dmp
memory/3492-93-0x0000000070010000-0x000000007005C000-memory.dmp
memory/4532-33-0x0000000006AD0000-0x0000000006B1C000-memory.dmp
memory/4532-47-0x0000000007F80000-0x00000000085FA000-memory.dmp
memory/4532-48-0x0000000007940000-0x000000000795A000-memory.dmp
memory/4532-49-0x00000000079B0000-0x00000000079BA000-memory.dmp
memory/4532-50-0x0000000007BC0000-0x0000000007C56000-memory.dmp
memory/4532-51-0x0000000007B40000-0x0000000007B51000-memory.dmp
memory/4532-52-0x0000000007B70000-0x0000000007B7E000-memory.dmp
memory/4532-53-0x0000000007B80000-0x0000000007B94000-memory.dmp
memory/4532-54-0x0000000007C80000-0x0000000007C9A000-memory.dmp
memory/4532-55-0x0000000007C60000-0x0000000007C68000-memory.dmp
memory/4532-58-0x00000000749C0000-0x0000000075170000-memory.dmp
memory/4532-46-0x0000000007800000-0x00000000078A3000-memory.dmp
memory/4532-45-0x00000000077D0000-0x00000000077EE000-memory.dmp
memory/4532-35-0x0000000070010000-0x000000007005C000-memory.dmp
memory/4532-34-0x0000000006BE0000-0x0000000006C12000-memory.dmp
memory/4532-32-0x0000000006620000-0x000000000663E000-memory.dmp
memory/4532-31-0x0000000006030000-0x0000000006384000-memory.dmp
memory/4532-20-0x0000000005EA0000-0x0000000005F06000-memory.dmp
memory/4532-21-0x0000000005FC0000-0x0000000006026000-memory.dmp
memory/4532-19-0x0000000005D80000-0x0000000005DA2000-memory.dmp
memory/4532-18-0x0000000005720000-0x0000000005D48000-memory.dmp
memory/4532-17-0x00000000749C0000-0x0000000075170000-memory.dmp
memory/4532-16-0x0000000002D20000-0x0000000002D56000-memory.dmp