Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250217-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
06/03/2025, 15:15
General
-
Target
XClient.exe
-
Size
32KB
-
MD5
488edd77586b5974047f6306f2fa76c6
-
SHA1
0d8954f5f4afb1715dc9f1bb2881a9f2f3b9f294
-
SHA256
dd72ca01f027c7e78eddab85ae78a2e5dadf0448efb881eee83ae58d78e6683a
-
SHA512
50ca70a8bb167e8054ed3bdcfc83c588851719f8d3935b4e7041031a23e45be157c2920672a8792eeac3121ab3e3f826c46f9a54cb3e7a3288e40ecf7921c1ba
-
SSDEEP
384:/YxRXcrP31VZBELRUnvJff3cdiwJVARJpkFTBLToOZwxJd2v99IkuisO3VFxOjhH:DPjgRevJ3cdXVAGF/9jpOjhTbf
Malware Config
Extracted
Family
xworm
Version
5.0
Mutex
7nuSUIfQmPuMEcMT
Attributes
-
install_file
USB.exe
-
pastebin_url
https://pastebin.com/raw/4zaiEtZS
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/4608-1-0x0000000000CB0000-0x0000000000CBE000-memory.dmp family_xworm -
Xworm family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 38 IoCs
flow ioc 24 pastebin.com 36 pastebin.com 62 pastebin.com 67 pastebin.com 68 pastebin.com 69 pastebin.com 71 pastebin.com 51 pastebin.com 55 pastebin.com 70 pastebin.com 76 pastebin.com 16 pastebin.com 23 pastebin.com 54 pastebin.com 56 pastebin.com 79 pastebin.com 85 pastebin.com 35 pastebin.com 38 pastebin.com 47 pastebin.com 84 pastebin.com 32 pastebin.com 50 pastebin.com 53 pastebin.com 73 pastebin.com 83 pastebin.com 15 pastebin.com 65 pastebin.com 77 pastebin.com 80 pastebin.com 18 pastebin.com 37 pastebin.com 52 pastebin.com 57 pastebin.com 60 pastebin.com 78 pastebin.com 81 pastebin.com 82 pastebin.com -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-983685854-559653692-675906587-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1544 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4608 XClient.exe Token: SeDebugPrivilege 1544 taskmgr.exe Token: SeSystemProfilePrivilege 1544 taskmgr.exe Token: SeCreateGlobalPrivilege 1544 taskmgr.exe Token: SeDebugPrivilege 2768 XClient.exe Token: SeDebugPrivilege 4840 XClient.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe 1544 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4608
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1544
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4268
-
C:\Users\Admin\Desktop\XClient.exe"C:\Users\Admin\Desktop\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2768
-
C:\Users\Admin\Desktop\XClient.exe"C:\Users\Admin\Desktop\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4840