Analysis
-
max time kernel
102s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
06/03/2025, 15:18
Behavioral task
behavioral1
Sample
XClient.exe
Resource
win7-20241010-en
windows7-x64
5 signatures
150 seconds
General
-
Target
XClient.exe
-
Size
32KB
-
MD5
488edd77586b5974047f6306f2fa76c6
-
SHA1
0d8954f5f4afb1715dc9f1bb2881a9f2f3b9f294
-
SHA256
dd72ca01f027c7e78eddab85ae78a2e5dadf0448efb881eee83ae58d78e6683a
-
SHA512
50ca70a8bb167e8054ed3bdcfc83c588851719f8d3935b4e7041031a23e45be157c2920672a8792eeac3121ab3e3f826c46f9a54cb3e7a3288e40ecf7921c1ba
-
SSDEEP
384:/YxRXcrP31VZBELRUnvJff3cdiwJVARJpkFTBLToOZwxJd2v99IkuisO3VFxOjhH:DPjgRevJ3cdXVAGF/9jpOjhTbf
Malware Config
Extracted
Family
xworm
Version
5.0
Mutex
7nuSUIfQmPuMEcMT
Attributes
-
install_file
USB.exe
-
pastebin_url
https://pastebin.com/raw/4zaiEtZS
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral2/memory/4100-1-0x00000000007C0000-0x00000000007CE000-memory.dmp family_xworm -
Xworm family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 34 IoCs
flow ioc 47 pastebin.com 74 pastebin.com 75 pastebin.com 79 pastebin.com 48 pastebin.com 77 pastebin.com 88 pastebin.com 93 pastebin.com 102 pastebin.com 44 pastebin.com 80 pastebin.com 90 pastebin.com 96 pastebin.com 101 pastebin.com 104 pastebin.com 37 pastebin.com 49 pastebin.com 60 pastebin.com 81 pastebin.com 97 pastebin.com 36 pastebin.com 82 pastebin.com 78 pastebin.com 91 pastebin.com 92 pastebin.com 94 pastebin.com 95 pastebin.com 46 pastebin.com 103 pastebin.com 33 pastebin.com 34 pastebin.com 43 pastebin.com 76 pastebin.com 89 pastebin.com -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 4100 XClient.exe Token: SeDebugPrivilege 1716 taskmgr.exe Token: SeSystemProfilePrivilege 1716 taskmgr.exe Token: SeCreateGlobalPrivilege 1716 taskmgr.exe Token: SeDebugPrivilege 3120 XClient.exe Token: 33 1716 taskmgr.exe Token: SeIncBasePriorityPrivilege 1716 taskmgr.exe Token: SeDebugPrivilege 2880 XClient.exe -
Suspicious use of FindShellTrayWindow 46 IoCs
pid Process 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe -
Suspicious use of SendNotifyMessage 46 IoCs
pid Process 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe 1716 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4100
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1716
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3120
-
C:\Users\Admin\Desktop\XClient.exe"C:\Users\Admin\Desktop\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
C:\Users\Admin\Desktop\XClient.exe"C:\Users\Admin\Desktop\XClient.exe"1⤵PID:2572
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1