Analysis
-
max time kernel
72s -
max time network
65s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250217-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
04/03/2025, 17:55
General
-
Target
XClient.exe
-
Size
38KB
-
MD5
f06449aeba429edebe5548a8d8c69c20
-
SHA1
7992d6ca53f7f864e7e8c35fabd8977f12501fce
-
SHA256
07103092725f8ea44b8c873d6d2db637453fffc42d05d0f3e02a51f05abce115
-
SHA512
3252e3d70e6af7c1c709682c8ecf9f6fcd37d2db74d12605d82acf99923c36b33bb1165560b4b3616fac51c4b6f2519960e32a41d3fc4d7cba72734df997fe92
-
SSDEEP
768:Qcf8pTYPfbEpjYnVQWbFo9BLMKA6+OwhxMvFG:QKEYX4SxFo9BLA6+OwQM
Malware Config
Extracted
Family
xworm
Version
3.1
C2
newsletter-effects.gl.at.ply.gg:42069
Mutex
OUUT3AwKbkkDRPZO
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/5064-1-0x00000000004F0000-0x0000000000500000-memory.dmp family_xworm -
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 ip-api.com -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1095212214-1383118828-1037266802-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5064 XClient.exe Token: SeDebugPrivilege 1592 taskmgr.exe Token: SeSystemProfilePrivilege 1592 taskmgr.exe Token: SeCreateGlobalPrivilege 1592 taskmgr.exe -
Suspicious use of FindShellTrayWindow 59 IoCs
pid Process 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe -
Suspicious use of SendNotifyMessage 59 IoCs
pid Process 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5064
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1592
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2008