Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250619-en
  • resource tags

    arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    30/06/2025, 17:41

General

  • Target

    SDGSD.exe

  • Size

    149KB

  • MD5

    ee4a28f13637b0f90a1865366fae40ae

  • SHA1

    ab5cd40ef781545f856c17e99a56f75eb313ac72

  • SHA256

    8e36d4f98a882487bedbedf73cbb010f793c7bb529d133a58673a14850198f9f

  • SHA512

    21956de80b478993ec01bdbe9094246c071ada646bf7a79363aa9be248f5b9e6b59b5e945f09d8f3747ce1afefdfc9b38f54f8edad2d20ddd8138eec2eb19c8d

  • SSDEEP

    3072:aQSkxWigJ7HcGU+6py9QzsMUKM8/TvzcI8ZuX1Kc:aKWigFHcX+ay6zsej/TvY

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %AppData%

  • install_file

    XWormClient.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops startup file 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SDGSD.exe
    "C:\Users\Admin\AppData\Local\Temp\SDGSD.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5708
    • C:\Users\Admin\AppData\Local\Temp\SDGSD.exe
      "C:\Users\Admin\AppData\Local\Temp\SDGSD.exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Accesses Microsoft Outlook profiles
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:1324
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SDGSD.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4628
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SDGSD.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5056
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XWormClient.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3040
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XWormClient.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5148

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SDGSD.exe.log

          Filesize

          617B

          MD5

          d55240f8b99e496184f63e4267526e2f

          SHA1

          5794350bb66640a7c9edbd9f7781d22db9002ea9

          SHA256

          c33677fa3ce521ce98ef3339484ce21a4fbab1138c6faf3f1821be56e8d3dfe2

          SHA512

          23ddf984d6ab71239e4caa3205c9b9ed507c10affb412b5c80fd927007e5cfdaedb65a0d5e13681a7df9b84f8578ff2fd8268b50311da1d4b213876479309ea6

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          ac4917a885cf6050b1a483e4bc4d2ea5

          SHA1

          b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f

          SHA256

          e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9

          SHA512

          092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          18KB

          MD5

          5d9edb62d8edcb00fd671075d7d3c11a

          SHA1

          1b2d4ad7dace6e66f96311653a730b18e03f24ce

          SHA256

          b71023856d5e150256a6a1666af018627da8eaf37c73287c4ac2f0bd1da1db21

          SHA512

          121015ddea3929dd1c8c5d1db1a30092fb0c72338760517249476b2f93374e7c602b5d2593a2a8e3513da848d128cd859ab3c66583a37aaf18a388ab676f3dff

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          18KB

          MD5

          2fc96a08b829028edaa7371b0906a6f7

          SHA1

          2938111ad3f632fe6bc0ae8fb07cb8463c2410eb

          SHA256

          7ec9c31081c4d19a6f91886ec271266aeb87b4c1fb3b8313457497256773c2ed

          SHA512

          26880eea19f4c797c55a7522c6836fd5cc602c7707401833ffed1cbb3d010d0af431d94fb4ce2d11cd1d49082a4e10ebb97ef0d676c70e4d97189bcbe6c1e5d3

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          18KB

          MD5

          bedfe30e72e12c83326438d87975753c

          SHA1

          c12e987395c5d3f6520f937e8d43885e00140674

          SHA256

          dc6e301311e6b78d7abed15bd0de457e1852c7d7c54346a16b86d229b399c5e5

          SHA512

          c1c3c32682ed36dfdceb60af364e481da3947438c55736028577b87a6472c2e854a43bca79ab5ceedf58fbfe95ff170fded908045cc77004dfe06ebb9c11eda7

        • C:\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

          Filesize

          742KB

          MD5

          544cd51a596619b78e9b54b70088307d

          SHA1

          4769ddd2dbc1dc44b758964ed0bd231b85880b65

          SHA256

          dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

          SHA512

          f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uj2s4msu.m2i.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • memory/1324-121-0x00000000071B0000-0x0000000007242000-memory.dmp

          Filesize

          584KB

        • memory/1324-120-0x00000000058F0000-0x0000000005900000-memory.dmp

          Filesize

          64KB

        • memory/1324-7-0x0000000000400000-0x0000000000418000-memory.dmp

          Filesize

          96KB

        • memory/1324-122-0x0000000007250000-0x00000000073F8000-memory.dmp

          Filesize

          1.7MB

        • memory/1324-119-0x00000000058F0000-0x0000000005900000-memory.dmp

          Filesize

          64KB

        • memory/1324-127-0x0000000007450000-0x0000000007460000-memory.dmp

          Filesize

          64KB

        • memory/1324-128-0x0000000008080000-0x0000000008242000-memory.dmp

          Filesize

          1.8MB

        • memory/3040-85-0x000000006FEE0000-0x000000006FF2C000-memory.dmp

          Filesize

          304KB

        • memory/3040-80-0x0000000005CA0000-0x0000000005FF7000-memory.dmp

          Filesize

          3.3MB

        • memory/4628-14-0x0000000005500000-0x0000000005522000-memory.dmp

          Filesize

          136KB

        • memory/4628-51-0x0000000007A30000-0x0000000007A38000-memory.dmp

          Filesize

          32KB

        • memory/4628-26-0x00000000063A0000-0x00000000063BE000-memory.dmp

          Filesize

          120KB

        • memory/4628-27-0x00000000063D0000-0x000000000641C000-memory.dmp

          Filesize

          304KB

        • memory/4628-28-0x000000007F670000-0x000000007F680000-memory.dmp

          Filesize

          64KB

        • memory/4628-29-0x0000000007370000-0x00000000073A4000-memory.dmp

          Filesize

          208KB

        • memory/4628-30-0x000000006FEE0000-0x000000006FF2C000-memory.dmp

          Filesize

          304KB

        • memory/4628-41-0x0000000006990000-0x00000000069AE000-memory.dmp

          Filesize

          120KB

        • memory/4628-40-0x00000000050F0000-0x0000000005100000-memory.dmp

          Filesize

          64KB

        • memory/4628-39-0x00000000050F0000-0x0000000005100000-memory.dmp

          Filesize

          64KB

        • memory/4628-42-0x00000000075B0000-0x0000000007654000-memory.dmp

          Filesize

          656KB

        • memory/4628-43-0x0000000007D30000-0x00000000083AA000-memory.dmp

          Filesize

          6.5MB

        • memory/4628-44-0x00000000076F0000-0x000000000770A000-memory.dmp

          Filesize

          104KB

        • memory/4628-45-0x0000000007760000-0x000000000776A000-memory.dmp

          Filesize

          40KB

        • memory/4628-46-0x0000000007990000-0x0000000007A26000-memory.dmp

          Filesize

          600KB

        • memory/4628-47-0x0000000007900000-0x0000000007911000-memory.dmp

          Filesize

          68KB

        • memory/4628-48-0x0000000007930000-0x000000000793E000-memory.dmp

          Filesize

          56KB

        • memory/4628-49-0x0000000007940000-0x0000000007955000-memory.dmp

          Filesize

          84KB

        • memory/4628-50-0x0000000007A50000-0x0000000007A6A000-memory.dmp

          Filesize

          104KB

        • memory/4628-25-0x0000000005EB0000-0x0000000006207000-memory.dmp

          Filesize

          3.3MB

        • memory/4628-16-0x0000000005E40000-0x0000000005EA6000-memory.dmp

          Filesize

          408KB

        • memory/4628-11-0x00000000050F0000-0x0000000005100000-memory.dmp

          Filesize

          64KB

        • memory/4628-15-0x0000000005DD0000-0x0000000005E36000-memory.dmp

          Filesize

          408KB

        • memory/4628-10-0x0000000002B90000-0x0000000002BC6000-memory.dmp

          Filesize

          216KB

        • memory/4628-12-0x00000000050F0000-0x0000000005100000-memory.dmp

          Filesize

          64KB

        • memory/4628-13-0x0000000005730000-0x0000000005D5A000-memory.dmp

          Filesize

          6.2MB

        • memory/5056-65-0x000000006FEE0000-0x000000006FF2C000-memory.dmp

          Filesize

          304KB

        • memory/5056-63-0x0000000005760000-0x0000000005AB7000-memory.dmp

          Filesize

          3.3MB

        • memory/5148-103-0x00000000057B0000-0x0000000005B07000-memory.dmp

          Filesize

          3.3MB

        • memory/5148-105-0x000000006FEE0000-0x000000006FF2C000-memory.dmp

          Filesize

          304KB

        • memory/5708-0-0x0000000000610000-0x000000000063C000-memory.dmp

          Filesize

          176KB

        • memory/5708-6-0x0000000005430000-0x0000000005444000-memory.dmp

          Filesize

          80KB

        • memory/5708-5-0x0000000005990000-0x0000000005F36000-memory.dmp

          Filesize

          5.6MB

        • memory/5708-4-0x00000000051F0000-0x0000000005200000-memory.dmp

          Filesize

          64KB

        • memory/5708-3-0x0000000005200000-0x000000000529C000-memory.dmp

          Filesize

          624KB

        • memory/5708-2-0x0000000002AA0000-0x0000000002AC4000-memory.dmp

          Filesize

          144KB

        • memory/5708-1-0x00000000051F0000-0x0000000005200000-memory.dmp

          Filesize

          64KB