Analysis
- user interaction
yes - max time kernel
150s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/08/2026, 13:21
Behavioral task
behavioral1
Sample
XClient.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target XClient.exe
- Size 30KB
- Sample260818-qlrxgahe49
- SHA256 04ad1c8b3b7fcd6459d7912d0a54de355ef599c671835d45e8c3f3671d314c5f
- MD5 8e5876cd4cf8ab39c78ba5e63c7c54ca
- SHA1 d2a4d35dbea54c3cfc159b634ab8c76f3890ec6c
- SHA512 844f57159223641cf3c5ad44beb0a9afed990795dc066ed5e1d4cb87a3aa81314841b8f0878a2ba991b67c2899420744d12eafd96ccb7c62f2496aa285e94380
- SSDEEP 384:t7wTA+5OfhxeelKn4MPLZhspJCXlYECwaiNnAsbRugtFuBLTIOZw/WVwvn9IkVuL:FFx7s4EQw1YETDNAsbBFR9RhoOqhNbT
- TLSH T123D24B087BE58327D9EF2FF229B291010275D807D923DF5E5CD895AB6F67A8143003EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
xworm
Version
-
3.0
C2
-
qq11qqaa22-34853.portmap.host:34853
Mutex
-
7pSrdBYU1znjeEkE
Attributes
-
install_file
USB.exe
aes.plain
Signatures
- Detect Xworm Payload 1 IoCs
resource yara_rule behavioral2/memory/2840-1-0x0000000000700000-0x000000000070E000-memory.dmp family_xworm - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2840 XClient.exe Token: SeDebugPrivilege 1240 taskmgr.exe Token: SeSystemProfilePrivilege 1240 taskmgr.exe Token: SeCreateGlobalPrivilege 1240 taskmgr.exe Token: 33 1240 taskmgr.exe Token: SeIncBasePriorityPrivilege 1240 taskmgr.exe - Suspicious use of FindShellTrayWindow 44 IoCs
pid Process 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe - Suspicious use of SendNotifyMessage 44 IoCs
pid Process 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe 1240 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1240 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2840
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1240