Resubmissions
07-04-2024 11:37
240407-nrb24abg9x 1009-10-2023 19:06
231009-xsc58aff91 1009-10-2023 19:00
231009-xnxn3ahg55 1009-10-2023 18:59
231009-xncc5aff7x 1001-10-2023 10:08
231001-l6g6jsaa3t 10Analysis
-
max time kernel
1387s -
max time network
1158s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
09-10-2023 19:06
General
-
Target
XWorm V5.0_Cracked/XWorm V5.0/MonoMod.Iced.dll
-
Size
623KB
-
MD5
c24584c6b5bc57ac46727ab15e332c4a
-
SHA1
dadd68f0fa45845fbc30fd0f8f54e8616cdd2d0b
-
SHA256
ef4a8f28226db390dd07de13afc01c8000e127c978ebf428a6637f39ac277033
-
SHA512
aabc699eef08e3483049c7ceb48842deddc52284de7f6f72d56d6eccac3989cc373839aeac61f03e7b2af203744d579fd96a4eb911cfdd0461b151c41dc6771d
-
SSDEEP
6144:Xw98C3SQzlfuStslPYAH+jUmLdf26bfDcj2511Qxu7F:q8CCYlfuGslPn+jvDTDcj251+xuR
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm V5.0_Cracked\XWorm V5.0\MonoMod.Iced.dll",#11⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB