Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
01-12-2022 16:45
General
-
Target
xLdJxISS0PQP.exe
-
Size
40KB
-
MD5
51f46d37bc176f8f28be7b27d9f59592
-
SHA1
36a756a60c756fe400a126da552237cf37d91945
-
SHA256
988eaf2a16406ea397d2ba14d98bcc09d5c56081fcc1f566709c63866b99ffbf
-
SHA512
a84a4eac99a654c34b1d5b69823f47e8d2decab5b0aba80c45314c87a2ecd060749be4499c10d93479207932896b776dbdb3b366d8be60ff919d4190fa6cce61
-
SSDEEP
768:mQ2dJcMPPNqZ2BdSBz0RpfhisQhLO0+ekj:BOdQcfw1Ovekj
Score
10/10
Malware Config
Extracted
Family
xworm
C2
liouas.ddns.net:8080
Mutex
aJySNEHayvVqunE1
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Xworm
Xworm is a remote access trojan written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\xLdJxISS0PQP.exe"C:\Users\Admin\AppData\Local\Temp\xLdJxISS0PQP.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
10.8MB