Analysis
-
max time kernel
570s -
max time network
570s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-01-2025 16:37
General
-
Target
XClient1 (1).exe
-
Size
71KB
-
MD5
aaa0991028b186830fc63c3a85b027ac
-
SHA1
4bf96ceb4da0f501cd3e1fafa9235628d5717eff
-
SHA256
3fb8d58a4307a082122f4cc8c192f5548b57c7ae4e4ed11a5acf4257ce751649
-
SHA512
ff14e3cc4f512f836258c9070d17fd72b2157f8180852204ca490c9f295026b43385dbbbf5285c2777e4c41ba8dbfd3db094bc6bf9cba71bf198af8e1bb25c80
-
SSDEEP
1536:IRUECHMT3yp4N5MwB52FmZbq2RQO2VN2OS0v0:INCHKicYFebqAQveOS0c
Malware Config
Extracted
Family
xworm
C2
147.185.221.25:2324
Attributes
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/2376-1-0x00000000006D0000-0x00000000006E8000-memory.dmp family_xworm -
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 ip-api.com -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2376 XClient1 (1).exe 2376 XClient1 (1).exe 2376 XClient1 (1).exe 2376 XClient1 (1).exe 2376 XClient1 (1).exe 2376 XClient1 (1).exe 2376 XClient1 (1).exe 2376 XClient1 (1).exe 2376 XClient1 (1).exe 2376 XClient1 (1).exe 2376 XClient1 (1).exe 2376 XClient1 (1).exe 2376 XClient1 (1).exe 2376 XClient1 (1).exe 2376 XClient1 (1).exe 2376 XClient1 (1).exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 2376 XClient1 (1).exe 2376 XClient1 (1).exe 2376 XClient1 (1).exe 2376 XClient1 (1).exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4672 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2376 XClient1 (1).exe Token: SeDebugPrivilege 2376 XClient1 (1).exe Token: SeDebugPrivilege 4672 taskmgr.exe Token: SeSystemProfilePrivilege 4672 taskmgr.exe Token: SeCreateGlobalPrivilege 4672 taskmgr.exe Token: SeDebugPrivilege 4696 XClient1 (1).exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe 4672 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2376 XClient1 (1).exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient1 (1).exe"C:\Users\Admin\AppData\Local\Temp\XClient1 (1).exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2376
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4672
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\XClient1 (1).exe"C:\Users\Admin\AppData\Local\Temp\XClient1 (1).exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4696