Analysis
-
max time kernel
148s -
max time network
143s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system -
submitted
30-06-2024 09:38
General
-
Target
XClient.exe
-
Size
329KB
-
MD5
51d7beb4236e50e6238389f7ede77227
-
SHA1
2cd6ef65f2af0d15764a94717af83d36512f3b2a
-
SHA256
5e83ca98a0a7200952afb3609975d0764d183090da422774f969e1b109b9b904
-
SHA512
2f060324a26dbabb37b9132defe703c65b00e4fc780844e58e1eff146971d09cfe8455479edd8e27c1f4bfb0ce8b0be6ffbc6042b6b5215970865b6269f15483
-
SSDEEP
6144:Yki6z0brsdgF+GIIIIIIIhIIIIIIIIIIIIIIIU:Y8z0si+
Malware Config
Extracted
Family
xworm
C2
127.0.0.1:1604
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2156-1-0x0000000000480000-0x00000000004D8000-memory.dmp family_xworm -
Drops startup file 2 IoCs
Processes:
XClient.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk XClient.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk XClient.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
XClient.exepid process 2156 XClient.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
XClient.exedescription pid process Token: SeDebugPrivilege 2156 XClient.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
XClient.exepid process 2156 XClient.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2156-0-0x00007FFF3C063000-0x00007FFF3C065000-memory.dmpFilesize
8KB
-
memory/2156-1-0x0000000000480000-0x00000000004D8000-memory.dmpFilesize
352KB
-
memory/2156-2-0x00007FFF3C060000-0x00007FFF3CB22000-memory.dmpFilesize
10.8MB
-
memory/2156-7-0x00007FFF3C060000-0x00007FFF3CB22000-memory.dmpFilesize
10.8MB