Analysis
- max time kernel
150s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
06/10/2023, 17:51
General
- Target bKWC.exe
- Size 56KB
- Sample231006-we54eaeg4y
- SHA256 83b91f098157b5ba0147972c1d5c4d751d66fc59d7645e2e643ce863101f6d52
Malware Config
Extracted
-
xworm
-
3.1
-
serverwindor.duckdns.org:5000
-
install_file
USB.exe
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bKWC.exe"C:\Users\Admin\AppData\Local\Temp\bKWC.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3216-5-0x0000021D04140000-0x0000021D04150000-memory.dmp
memory/3216-21-0x0000021D04240000-0x0000021D04250000-memory.dmp
memory/3216-37-0x0000021D0C590000-0x0000021D0C591000-memory.dmp
memory/3216-39-0x0000021D0C5C0000-0x0000021D0C5C1000-memory.dmp
memory/3216-40-0x0000021D0C5C0000-0x0000021D0C5C1000-memory.dmp
memory/3216-41-0x0000021D0C6D0000-0x0000021D0C6D1000-memory.dmp
memory/4700-0-0x00000000009C0000-0x00000000009D4000-memory.dmp
memory/4700-1-0x00007FF9A7570000-0x00007FF9A8031000-memory.dmp
memory/4700-2-0x000000001B7D0000-0x000000001B7E0000-memory.dmp
memory/4700-3-0x00007FF9A7570000-0x00007FF9A8031000-memory.dmp
memory/4700-4-0x000000001B7D0000-0x000000001B7E0000-memory.dmp