Overview

overview

10

Static

static

10

XClient2.exe

windows7-x64

10

XClient2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    82s
  • max time network
    76s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19-01-2025 01:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    XClient2.exe

  • Size

    73KB

  • MD5

    b2ef5f0f3fc231b44618d23072656ba2

  • SHA1

    a235bfd290aa924ef88d3904cc708151776bcb21

  • SHA256

    0ebf810b5f45b14e23e4c979a01234713a1716f6ddc406f1205cb913c5bb4331

  • SHA512

    ce174b8c75a45a4664dc1f1957c78fc802cddb00a88310e41ff35e0b6e376e88e3a8ce87111c53c36189e5f650b25e2d41586fcb16dabe732a27138307aeeac3

  • SSDEEP

    1536:axMzsl89sXDQ7wfhaGyH8T+bX04b/6ugpOpeL2llU:axgsaeBYlbXVUpOpeLolU

Score
10/10
xwormexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

C2

virtual-pointed.gl.at.ply.gg:17000

virtual-pointed.gl.at.ply.gg:17000:17000

127.0.0.1:17000
Attributes
  • Install_directory

    %Temp%

  • install_file

    svchost.exe

Signatures

  • Detect Xworm Payload 3 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 33 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\XClient2.exe
    "C:\Users\Admin\AppData\Local\Temp\XClient2.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2492
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient2.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2832
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient2.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2744
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2820
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2004
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2732
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2888
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {9A7DCBE3-267A-46AC-8F75-6269AE344822} S-1-5-21-3063565911-2056067323-3330884624-1000:KHBTHJFA\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Users\Admin\AppData\Local\Temp\svchost.exe
      C:\Users\Admin\AppData\Local\Temp\svchost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2920

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\svchost.exe
    Filesize

    73KB

    MD5

    b2ef5f0f3fc231b44618d23072656ba2

    SHA1

    a235bfd290aa924ef88d3904cc708151776bcb21

    SHA256

    0ebf810b5f45b14e23e4c979a01234713a1716f6ddc406f1205cb913c5bb4331

    SHA512

    ce174b8c75a45a4664dc1f1957c78fc802cddb00a88310e41ff35e0b6e376e88e3a8ce87111c53c36189e5f650b25e2d41586fcb16dabe732a27138307aeeac3

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
    Filesize

    7KB

    MD5

    02a3efbf51f2019666ad445b22d8f115

    SHA1

    e9a6638b23918d8f242c8c7b9bf332dda18e6b16

    SHA256

    e8fb7f455802b68aed9ec138b7df1bec3e46487dff1cd3fe9d7ab5bc4ba6ac21

    SHA512

    ee1796fc174226c77d4692619698e64ee4be470fc06431883865e3800bf55cf9ace8818f110718492fe426e02d5294a270b27952b029eb99becbdabac908163d

    Download Submit

  • memory/2492-17-0x000007FEF5BE3000-0x000007FEF5BE4000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2492-2-0x000007FEF5BE0000-0x000007FEF65CC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2492-0-0x000007FEF5BE3000-0x000007FEF5BE4000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2492-33-0x000007FEF5BE0000-0x000007FEF65CC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2492-1-0x0000000001110000-0x0000000001128000-memory.dmp

    Filesize

    96KB

    Download

  • memory/2744-15-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/2744-16-0x0000000002A60000-0x0000000002A68000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2832-7-0x0000000002720000-0x00000000027A0000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2832-8-0x000000001B740000-0x000000001BA22000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/2832-9-0x0000000001F80000-0x0000000001F88000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2888-32-0x0000000140000000-0x00000001405E8000-memory.dmp

    Filesize

    5.9MB

    Download

  • memory/2888-34-0x0000000140000000-0x00000001405E8000-memory.dmp

    Filesize

    5.9MB

    Download

  • memory/2920-38-0x0000000001390000-0x00000000013A8000-memory.dmp

    Filesize

    96KB

    Download