xworm | d51f42146e8941faab7f80174bd0245a93fcd92f42614887b8b2d556e4d76228 | Triage

Analysis

max time kernel
121s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2023 19:04

Sharing

Report Analysis Logs

General

Target

a.exe
Size

34KB
MD5

832a42b740a57843dc44adefd7c2c7db
SHA1

f0d60f281aa0a39f2078f9a5ae3664e3c63fa9e5
SHA256

d51f42146e8941faab7f80174bd0245a93fcd92f42614887b8b2d556e4d76228
SHA512

9af0bdf0ba3fbdbab24cba5cfca67eb24b5f2752e9c8f1acdea4f7fc93d16b0e4cca2df34417c5c6ecc566686d773e61d09f0b020f02032ff6ec04e078b02cdd
SSDEEP

768:STaKn2v/mYSTayNNOFM9hstuhO9hASEsRbyp:Sm/ejNAFM9hstuhO9ygRbC

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

C2

193.42.33.22:5555

Mutex

CaE60WfjVddH5yYo

Attributes

install_file
USB.exe

aes.plain

Signatures

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

a.exe

pid process

1912 a.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a.exe

description pid process

Token: SeDebugPrivilege 1912 a.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

a.exe

pid process

1912 a.exe

C:\Users\Admin\AppData\Local\Temp\a.exe
"C:\Users\Admin\AppData\Local\Temp\a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1912-133-0x0000000000C40000-0x0000000000C4E000-memory.dmp

Filesize
56KB

Download
memory/1912-134-0x000000001C300000-0x000000001C310000-memory.dmp

Filesize
64KB

Download
memory/1912-135-0x000000001C300000-0x000000001C310000-memory.dmp

Filesize
64KB

Download