xworm | 7fbe457642ca009844b0d1b1954a8bef366106e5c57aa14f8d2a21ba068ebf3d | Triage

Analysis

max time kernel
148s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22-05-2023 13:21

Sharing

Report Analysis Logs

General

Target

Startup808.exe
Size

89KB
MD5

a70c18e10d0354343abd35f8ac58fa44
SHA1

b23db8f93db6698e94759c6f70dc7c0613fb9991
SHA256

7fbe457642ca009844b0d1b1954a8bef366106e5c57aa14f8d2a21ba068ebf3d
SHA512

7dd69b4e49d129a778361d7fc169bbd416ec528fe135deaafcb121f51727794b96b7490f1542d8b4eb669b2499cb25d33ffeb0d522bf660b7fc75489ee73d02d
SSDEEP

768:b1+fVlEijbCNYyYLIJVBk6uiKdVCvImRDdQSyYrPf1nFoxWyGPrw6T:bkX4NyIgmdDQgJFoEyIrLT

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Mutex

FXmrprvXafQA5uOz

Attributes

install_file
USB.exe

aes.plain

Signatures

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Startup808.exe	Startup808.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Startup808.exe	Startup808.exe

C:\Users\Admin\AppData\Local\Temp\Startup808.exe
"C:\Users\Admin\AppData\Local\Temp\Startup808.exe"
1⤵
- Drops startup file
PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-54-0x0000000000C10000-0x0000000000C2C000-memory.dmp

Filesize
112KB

Download
memory/2040-57-0x000000001B0B0000-0x000000001B130000-memory.dmp

Filesize
512KB

Download