Analysis
-
max time kernel
3s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
30-06-2024 11:08
General
-
Target
XC12lient.exe
-
Size
60KB
-
MD5
80000eb10a99df44b557670aded4d0bf
-
SHA1
861f71e942652a8cea932de335c1d577e3147299
-
SHA256
2297d34f5b6e39fb06ea7ee6f9fb1c6572b7a98b4c76a5c3bfd4dd351926b1ff
-
SHA512
c88d3af7ed0b1005da734f40a9947f44eef68d769086f906855d4a718584ee84eed14c2b963aed433aaefba2b4bd57e03a1cc92b1f1712e6d40b4cac80c3f6da
-
SSDEEP
1536:iNqQAXim/v4vO9Hru5o8eWwbH3EanV6EOcOSED:icZ/m8HreoJbHHHOcOTD
Malware Config
Extracted
xworm
3.1
2.tcp.eu.ngrok.io:11215
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3412-0-0x0000000000A50000-0x0000000000A66000-memory.dmp family_xworm C:\Users\Admin\AppData\Roaming\XC12lient.exe family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepid process 4404 powershell.exe 4860 powershell.exe 3628 powershell.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
XC12lient.exedescription pid process Token: SeDebugPrivilege 3412 XC12lient.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XC12lient.exe"C:\Users\Admin\AppData\Local\Temp\XC12lient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XC12lient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XC12lient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XC12lient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XC12lient" /tr "C:\Users\Admin\AppData\Roaming\XC12lient.exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Roaming\XC12lient.exeC:\Users\Admin\AppData\Roaming\XC12lient.exe1⤵
-
C:\Users\Admin\AppData\Roaming\XC12lient.exeC:\Users\Admin\AppData\Roaming\XC12lient.exe1⤵
-
C:\Users\Admin\AppData\Roaming\XC12lient.exeC:\Users\Admin\AppData\Roaming\XC12lient.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XC12lient.exe.logFilesize
654B
MD52cbbb74b7da1f720b48ed31085cbd5b8
SHA179caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA256e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
SHA512ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5627073ee3ca9676911bee35548eff2b8
SHA14c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA25685b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA5123c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD51a9fa92a4f2e2ec9e244d43a6a4f8fb9
SHA19910190edfaccece1dfcc1d92e357772f5dae8f7
SHA2560ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888
SHA5125d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5051a74485331f9d9f5014e58ec71566c
SHA14ed0256a84f2e95609a0b4d5c249bca624db8fe4
SHA2563f67e4ba795fd89d33e9a1fe7547e297a82ae50b8f25eedc2b33a27866b28888
SHA5121f15fd8ca727b198495ef826002c1cbcc63e98eecb2e92abff48354ae668e6c3aaf9bd3005664967ae75637bacee7e730ce36142483d08ae6a068d9ae3e0e17d
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yqahpu4q.d23.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\XC12lient.exeFilesize
60KB
MD580000eb10a99df44b557670aded4d0bf
SHA1861f71e942652a8cea932de335c1d577e3147299
SHA2562297d34f5b6e39fb06ea7ee6f9fb1c6572b7a98b4c76a5c3bfd4dd351926b1ff
SHA512c88d3af7ed0b1005da734f40a9947f44eef68d769086f906855d4a718584ee84eed14c2b963aed433aaefba2b4bd57e03a1cc92b1f1712e6d40b4cac80c3f6da
-
memory/3412-1-0x00007FF909993000-0x00007FF909995000-memory.dmpFilesize
8KB
-
memory/3412-2-0x00007FF909990000-0x00007FF90A452000-memory.dmpFilesize
10.8MB
-
memory/3412-0-0x0000000000A50000-0x0000000000A66000-memory.dmpFilesize
88KB
-
memory/3412-50-0x00007FF909990000-0x00007FF90A452000-memory.dmpFilesize
10.8MB
-
memory/4404-8-0x000001F8912B0000-0x000001F8912D2000-memory.dmpFilesize
136KB
-
memory/4404-17-0x00007FF909990000-0x00007FF90A452000-memory.dmpFilesize
10.8MB
-
memory/4404-14-0x00007FF909990000-0x00007FF90A452000-memory.dmpFilesize
10.8MB
-
memory/4404-13-0x00007FF909990000-0x00007FF90A452000-memory.dmpFilesize
10.8MB
-
memory/4404-12-0x00007FF909990000-0x00007FF90A452000-memory.dmpFilesize
10.8MB