Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250113-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
19-01-2025 13:19
Behavioral task
behavioral1
Sample
XClient.exe
Resource
win10ltsc2021-20250113-en
windows10-ltsc 2021-x64
Behavioral task
behavioral2
Sample
XClient.exe
Resource
win11-20241007-en
windows11-21h2-x64
General
-
Target
XClient.exe
-
Size
30KB
-
MD5
cc5d15bc880b21e4912741f3146847fe
-
SHA1
864f8e552e145f4119cf87d2cd313c28e5922190
-
SHA256
477c5ee702c71036f0bd3d9610c98c3b95231e586d98b9595a13bca8a9719ada
-
SHA512
c989affb9a05f369d6c7dd37ca135cb99c0792a1265e6e4f73f5af8c4f75e0177529e783652cb6b9d93f67b857ea59fb7c7abbed0db84481d549204c8e948740
-
SSDEEP
384:K7wTA+5OfPgEBQqWvfcQLZe3s80hYACSqR/inw2uRugtFuBLTIOZw/WVnvn9IkV3:UrgECfLH8MYAoR/iw2uBFE9RiOqh0bl
Malware Config
Extracted
xworm
3.1
airport-forums.gl.at.ply.gg:20417
ZPSZiwa5h9FUM0MJ
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/4448-1-0x0000000000C80000-0x0000000000C8E000-memory.dmp family_xworm -
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2826969134-2088669430-2680400721-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bnnvwz.exe" bnnvwz.exe -
Xworm family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2826969134-2088669430-2680400721-1000\Control Panel\International\Geo\Nation XClient.exe -
Executes dropped EXE 1 IoCs
pid Process 4484 bnnvwz.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2826969134-2088669430-2680400721-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\userini = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bnnvwz.exe" bnnvwz.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnvwz.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4448 XClient.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe 4484 bnnvwz.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4448 wrote to memory of 4484 4448 XClient.exe 84 PID 4448 wrote to memory of 4484 4448 XClient.exe 84 PID 4448 wrote to memory of 4484 4448 XClient.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\bnnvwz.exe"C:\Users\Admin\AppData\Local\Temp\bnnvwz.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:4484
-
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3080
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
436KB
MD522ba54cbf5c8a41d64acc90f467c1fb5
SHA15f61b932b5e151a4a460ada8e5ae8b268093a98f
SHA256c02c44870579dcd8208b140dd85066bd7a468934d49b227aa24e6e62b951c35d
SHA512cc62b9edaff1fc771e721acef84e854d93b5210f2148fa62dc4a0e3f3c8548e0686a8c250aad4292f380fdf4c50d746ef1309f3b9995518faa3d0fc207102295