Resubmissions
21-01-2025 05:58
250121-gphcrszkgv 10Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250113-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
21-01-2025 05:58
General
-
Target
XClient.exe
-
Size
33KB
-
MD5
179482cceb10d4670100eb9a630bb311
-
SHA1
99cbb9197c893ab46b6110d2235f91daf1d41513
-
SHA256
2da37fb7b6f492f2075da78b374057fb94e27a80165d48a5c728ddf5d7819233
-
SHA512
204006f23a305602fdf304f69eb74233bc0cdb8844779b3266cbdec529629f2a7840a1d18409bc251b0c39811268533334a9d3204baf3ef6804e52947ac2cc46
-
SSDEEP
384:Tl+PkjD9+E5MFs7iui8L7zKM42pfL3iB7OxVqWqKRApkFXBLTsOZwpGN2v99IkuW:J+CD93W03v42JiB70lVF49j9vOjhWbD
Malware Config
Extracted
Family
xworm
Version
5.0
C2
46.146.46.81:7000
46.146.46.81:7000:7000
Mutex
fbhq2WHCedXyFd07
Attributes
-
install_file
svchost.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/4940-1-0x0000000000530000-0x000000000053E000-memory.dmp family_xworm -
Xworm family
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1132 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4940 XClient.exe Token: SeDebugPrivilege 1132 taskmgr.exe Token: SeSystemProfilePrivilege 1132 taskmgr.exe Token: SeCreateGlobalPrivilege 1132 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe 1132 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4940
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1132
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3820