Overview

overview

10

Static

static

10

46f16261cc...b9.exe

windows7-x64

10

46f16261cc...b9.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    293s
  • max time network
    299s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    25-03-2023 05:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    46f16261cc1ad6d2975a966ad97ef1752027e67795333a27ed01353d688317b9.exe

  • Size

    62KB

  • MD5

    664239722df2540dc9383696b7ded567

  • SHA1

    f9d7fa86edc0a189a1e281b01d30613dcce58e53

  • SHA256

    46f16261cc1ad6d2975a966ad97ef1752027e67795333a27ed01353d688317b9

  • SHA512

    26521e23f3d2c7f5533577611dec88a9f5d06b6bdc34fdfe5cd2f83c60b8c878938aa452c1d54a46d04e7b17cd1d3533dae028b1b226aaad2ec3f50b8e24bf3e

  • SSDEEP

    1536:XxKtcSMzgqpjqM0vGT+Xab1ZwetHvt+tlRgOp97P:hGMz5jqM0uT+Xab1t5t+toOp97P

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

C2

venom.giize.com:46876

Attributes
  • install_file

    USB.exe

Signatures

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Drops startup file 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\46f16261cc1ad6d2975a966ad97ef1752027e67795333a27ed01353d688317b9.exe
    "C:\Users\Admin\AppData\Local\Temp\46f16261cc1ad6d2975a966ad97ef1752027e67795333a27ed01353d688317b9.exe"
    1⤵
    • Drops startup file
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of AdjustPrivilegeToken
    PID:944

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/944-54-0x0000000000310000-0x0000000000326000-memory.dmp
    Filesize

    88KB

    Download
  • memory/944-59-0x000000001B2D0000-0x000000001B350000-memory.dmp
    Filesize

    512KB

    Download
  • memory/944-60-0x000000001B2D0000-0x000000001B350000-memory.dmp
    Filesize

    512KB

    Download