Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
19-01-2025 13:19
Behavioral task
behavioral1
Sample
XClient.exe
Resource
win10ltsc2021-20250113-en
windows10-ltsc 2021-x64
Behavioral task
behavioral2
Sample
XClient.exe
Resource
win11-20241007-en
windows11-21h2-x64
General
-
Target
XClient.exe
-
Size
30KB
-
MD5
cc5d15bc880b21e4912741f3146847fe
-
SHA1
864f8e552e145f4119cf87d2cd313c28e5922190
-
SHA256
477c5ee702c71036f0bd3d9610c98c3b95231e586d98b9595a13bca8a9719ada
-
SHA512
c989affb9a05f369d6c7dd37ca135cb99c0792a1265e6e4f73f5af8c4f75e0177529e783652cb6b9d93f67b857ea59fb7c7abbed0db84481d549204c8e948740
-
SSDEEP
384:K7wTA+5OfPgEBQqWvfcQLZe3s80hYACSqR/inw2uRugtFuBLTIOZw/WVnvn9IkV3:UrgECfLH8MYAoR/iw2uBFE9RiOqh0bl
Malware Config
Extracted
xworm
3.1
airport-forums.gl.at.ply.gg:20417
ZPSZiwa5h9FUM0MJ
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral2/memory/3124-1-0x0000000000DD0000-0x0000000000DDE000-memory.dmp family_xworm -
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\adofvc.exe" adofvc.exe -
Xworm family
-
Executes dropped EXE 1 IoCs
pid Process 4884 adofvc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\userini = "C:\\Users\\Admin\\AppData\\Local\\Temp\\adofvc.exe" adofvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language adofvc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3124 XClient.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe 4884 adofvc.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3124 wrote to memory of 4884 3124 XClient.exe 80 PID 3124 wrote to memory of 4884 3124 XClient.exe 80 PID 3124 wrote to memory of 4884 3124 XClient.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\adofvc.exe"C:\Users\Admin\AppData\Local\Temp\adofvc.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:4884
-
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4552
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
436KB
MD522ba54cbf5c8a41d64acc90f467c1fb5
SHA15f61b932b5e151a4a460ada8e5ae8b268093a98f
SHA256c02c44870579dcd8208b140dd85066bd7a468934d49b227aa24e6e62b951c35d
SHA512cc62b9edaff1fc771e721acef84e854d93b5210f2148fa62dc4a0e3f3c8548e0686a8c250aad4292f380fdf4c50d746ef1309f3b9995518faa3d0fc207102295