Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
01-12-2022 16:45
General
-
Target
ef8ef13ebedc898411ca5d77d7aa4372.exe
-
Size
43KB
-
MD5
ef8ef13ebedc898411ca5d77d7aa4372
-
SHA1
886c8482b323cba3824bb6bf2e6ffe02980f030b
-
SHA256
d13d39da36d9a911d5510a062c3a5eaf3a7645672515e139f90f74641f04d636
-
SHA512
0bc4fbd83613ad64b11687d2ff3b36cac1d0fbc02b230cf880b5f08bc37b56772389f48eeb256c26e7bea9f807c37e5e8132758ba86a1ad4f16e7362b0f68b0a
-
SSDEEP
768:8n/iPHWz9UsOVJe3Lm5QsrI5bP+UGdQkxwyjlO9CjNQdjhk:8/iPoUVJeSSsE5bizxdQKMjhk
Score
10/10
Malware Config
Extracted
Family
xworm
C2
199.66.93.150:1337
Mutex
DE0kMyVTyHdrXVKh
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Xworm
Xworm is a remote access trojan written in C#.
-
Drops startup file 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef8ef13ebedc898411ca5d77d7aa4372.exe"C:\Users\Admin\AppData\Local\Temp\ef8ef13ebedc898411ca5d77d7aa4372.exe"1⤵
- Drops startup file
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
10.8MB