Analysis
-
max time kernel
133s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
01-12-2022 16:45
General
-
Target
1877b7bcc1bc998e1d4e53a55cb1cd4c.exe
-
Size
40KB
-
MD5
1877b7bcc1bc998e1d4e53a55cb1cd4c
-
SHA1
55e6c2f9a9325b79938bafa82ef5b76f030a912b
-
SHA256
2c24d359f441614a46f56ce5c94a361cdfd03cd1bf91a99b1183675d6bf362a9
-
SHA512
072c9aa2f849728b088dcc15bb2285942288df9e807eeb20917eafe522e1d73607c6e2565eef3d9478f0db3d480691cd3803684126cdf50548ef22b14f654bce
-
SSDEEP
384:0/z/7roZ+lv83FLWnCqbmnaQDcag7zuPgg7Kx493yBtrLaWGPjxLCPOnsSZwHBWx:g/7roZ+v81mvx7zgJKd3yWWtRF3
Score
10/10
Malware Config
Extracted
Family
xworm
C2
206.189.139.209:20715
Mutex
nsQFsyCH3iPZkMHA
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Xworm
Xworm is a remote access trojan written in C#.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1877b7bcc1bc998e1d4e53a55cb1cd4c.exe"C:\Users\Admin\AppData\Local\Temp\1877b7bcc1bc998e1d4e53a55cb1cd4c.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB