Analysis
-
max time kernel
126s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-01-2025 01:07
Behavioral task
behavioral1
Sample
XCnigga.exe
Resource
win7-20240903-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
XCnigga.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
XCnigga.exe
-
Size
74KB
-
MD5
6b67af317eaed9595eb9ee513372cd74
-
SHA1
2350eb719b4d5ddd8da7247ec637fba5be994204
-
SHA256
24201bf218d04d65430b3fa6100779967b1ed77ffb94fc986522861c429ec3e6
-
SHA512
ca8015b8e4d67d705eb17ed80302bf4eceea14d5386cd096d6b73e4a6694ef8e8c734a674c8218361842f22e8d1b2dc1523b87984fcbe08a374938ad5e545d1f
-
SSDEEP
1536:5nVzXcWbHadoyrUXbLjuogFWDg6nO6NRYKN4:37bHuXIbLj3g0DVO6Nd4
Score
10/10
Malware Config
Extracted
Family
xworm
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
-
pastebin_url
https://pastebin.com/raw/6wUPPUDa
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/2108-1-0x0000000000840000-0x0000000000858000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2808 powershell.exe 2840 powershell.exe 2652 powershell.exe 3044 powershell.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk XCnigga.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk XCnigga.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe" XCnigga.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 37 IoCs
flow ioc 19 pastebin.com 20 pastebin.com 24 pastebin.com 31 pastebin.com 35 pastebin.com 7 pastebin.com 10 pastebin.com 12 pastebin.com 14 pastebin.com 21 pastebin.com 41 pastebin.com 15 pastebin.com 17 pastebin.com 42 pastebin.com 11 pastebin.com 16 pastebin.com 26 pastebin.com 29 pastebin.com 38 pastebin.com 39 pastebin.com 40 pastebin.com 18 pastebin.com 22 pastebin.com 27 pastebin.com 32 pastebin.com 37 pastebin.com 36 pastebin.com 6 pastebin.com 9 pastebin.com 25 pastebin.com 28 pastebin.com 30 pastebin.com 33 pastebin.com 34 pastebin.com 8 pastebin.com 13 pastebin.com 23 pastebin.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 2808 powershell.exe 2840 powershell.exe 2652 powershell.exe 3044 powershell.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2136 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 2108 XCnigga.exe Token: SeDebugPrivilege 2808 powershell.exe Token: SeDebugPrivilege 2840 powershell.exe Token: SeDebugPrivilege 2652 powershell.exe Token: SeDebugPrivilege 3044 powershell.exe Token: SeDebugPrivilege 1644 taskmgr.exe Token: SeDebugPrivilege 2136 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 1644 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe 2136 taskmgr.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2108 wrote to memory of 2808 2108 XCnigga.exe 31 PID 2108 wrote to memory of 2808 2108 XCnigga.exe 31 PID 2108 wrote to memory of 2808 2108 XCnigga.exe 31 PID 2108 wrote to memory of 2840 2108 XCnigga.exe 33 PID 2108 wrote to memory of 2840 2108 XCnigga.exe 33 PID 2108 wrote to memory of 2840 2108 XCnigga.exe 33 PID 2108 wrote to memory of 2652 2108 XCnigga.exe 35 PID 2108 wrote to memory of 2652 2108 XCnigga.exe 35 PID 2108 wrote to memory of 2652 2108 XCnigga.exe 35 PID 2108 wrote to memory of 3044 2108 XCnigga.exe 37 PID 2108 wrote to memory of 3044 2108 XCnigga.exe 37 PID 2108 wrote to memory of 3044 2108 XCnigga.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\XCnigga.exe"C:\Users\Admin\AppData\Local\Temp\XCnigga.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XCnigga.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2808
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XCnigga.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2840
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2652
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3044
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1644
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2136
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk1⤵
- Modifies registry class
PID:2152
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD59552a652d87cbe04b886e445ada782a5
SHA1ee2e1f78fbc6face21ac6a65be0c3ac6e411326b
SHA2569b0f7ab8cebebbb913aabad1024a84acf04cb6de7ab8cf7d5883a5d54e46b3ce
SHA512da641bf7a14446c2bbe69548a320909eb6314d97390c75d1c4c75dcc7cf769e4dd6b78014014ea76e835896f95a6a2cb86e40ec2224649a03ecc464b3649b56f