Analysis
-
max time kernel
146s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
06-10-2023 20:51
General
-
Target
NEAS.bKQSexe_JC.exe
-
Size
55KB
-
MD5
b51dbe03a7d7ed5046b6c75593ec2090
-
SHA1
f5279fab9888b810cbdebebb8eab8d8025228023
-
SHA256
50cc18e65b1e6ca61f84eb2e255af53d1088db17585675c7eccc7a2236c13606
-
SHA512
b892fb1925e3e7a362bb55f0750a50a2a1aad8aad1bc8ed2055d9dd8c7cc1157a843c12a5a72e4deeab5dcd15097d85235a5c106f7197001903dd66f206d3c26
-
SSDEEP
1536:MmwablEM7GSILzczbVFos9ptzOMlz7bB42:MRJpzczbVr9Oiz7y2
Score
10/10
Malware Config
Extracted
Family
xworm
Version
3.1
C2
serverwindor.duckdns.org:5000
Attributes
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.bKQSexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.bKQSexe_JC.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
512KB