Analysis
-
max time kernel
31s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
12-06-2023 05:41
General
-
Target
XClient.exe
-
Size
31KB
-
MD5
9a152a95f8e2d4d331bd86da740fa1d7
-
SHA1
f91dd6c0bb667132fb9877bc168c25a771c254ec
-
SHA256
3209fafd8badfa697691cfbdb206a07725df42c2e6b3b05c2f54b9d66fef018b
-
SHA512
a7da8fdad07020665f2e9430d38cc5f1b1b70bbd53a8e2130609bf461051b6c44914432d67ca45b73d4b356289e55a66b8f165b0dd12f16eec7055ceb7f264bc
-
SSDEEP
384:EeAwIGmeffcbWICWv/0ILZGPc7B0hYACSqRr4TKuRugtFuBLTIOZw/WVnvn9IkVI:Yecbl/b37BMYAoRsuuBFE9R+ROqh8b0
Score
10/10
Malware Config
Extracted
Family
xworm
C2
109.195.94.247:7000
Mutex
qONggGYjwC240XZ4
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Xworm
Xworm is a remote access trojan written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
-
Filesize
512KB
-
Filesize
512KB