Analysis
-
max time kernel
899s -
max time network
903s -
platform
windows11-21h2_x64 -
resource
win11-20250217-en -
resource tags
arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system -
submitted
06/03/2025, 15:42
General
-
Target
XClient.exe
-
Size
32KB
-
MD5
488edd77586b5974047f6306f2fa76c6
-
SHA1
0d8954f5f4afb1715dc9f1bb2881a9f2f3b9f294
-
SHA256
dd72ca01f027c7e78eddab85ae78a2e5dadf0448efb881eee83ae58d78e6683a
-
SHA512
50ca70a8bb167e8054ed3bdcfc83c588851719f8d3935b4e7041031a23e45be157c2920672a8792eeac3121ab3e3f826c46f9a54cb3e7a3288e40ecf7921c1ba
-
SSDEEP
384:/YxRXcrP31VZBELRUnvJff3cdiwJVARJpkFTBLToOZwxJd2v99IkuisO3VFxOjhH:DPjgRevJ3cdXVAGF/9jpOjhTbf
Malware Config
Extracted
Family
xworm
Version
5.0
Mutex
7nuSUIfQmPuMEcMT
Attributes
-
install_file
USB.exe
-
pastebin_url
https://pastebin.com/raw/4zaiEtZS
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/2516-1-0x0000000000A30000-0x0000000000A3E000-memory.dmp family_xworm -
Xworm family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs
flow ioc 21 pastebin.com 22 pastebin.com 104 pastebin.com 113 pastebin.com 153 pastebin.com 273 pastebin.com 274 pastebin.com 6 pastebin.com 79 pastebin.com 221 pastebin.com 7 pastebin.com 119 pastebin.com 163 pastebin.com 208 pastebin.com 262 pastebin.com 51 pastebin.com 91 pastebin.com 109 pastebin.com 118 pastebin.com 151 pastebin.com 239 pastebin.com 269 pastebin.com 17 pastebin.com 24 pastebin.com 42 pastebin.com 138 pastebin.com 176 pastebin.com 253 pastebin.com 259 pastebin.com 189 pastebin.com 195 pastebin.com 214 pastebin.com 218 pastebin.com 83 pastebin.com 85 pastebin.com 156 pastebin.com 162 pastebin.com 46 pastebin.com 95 pastebin.com 134 pastebin.com 140 pastebin.com 69 pastebin.com 81 pastebin.com 108 pastebin.com 117 pastebin.com 125 pastebin.com 94 pastebin.com 99 pastebin.com 180 pastebin.com 187 pastebin.com 209 pastebin.com 260 pastebin.com 80 pastebin.com 121 pastebin.com 172 pastebin.com 205 pastebin.com 245 pastebin.com 56 pastebin.com 278 pastebin.com 98 pastebin.com 215 pastebin.com 1 pastebin.com 160 pastebin.com 291 pastebin.com -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsTerminal_8wekyb3d8bbwe\StartTerminalOnLoginTask taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1660 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2516 XClient.exe Token: SeDebugPrivilege 1660 taskmgr.exe Token: SeSystemProfilePrivilege 1660 taskmgr.exe Token: SeCreateGlobalPrivilege 1660 taskmgr.exe Token: SeDebugPrivilege 1688 XClient.exe Token: SeDebugPrivilege 3984 XClient.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe 1660 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2516
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1660
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1688
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3984