Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
12/10/2023, 04:42
General
-
Target
winlogin.exe
-
Size
40KB
-
MD5
64aa45857bbf819ca0516126748ddfdb
-
SHA1
7b57da0f3115410b67456983b72df35c0f168ba8
-
SHA256
02cda252627b911029c6123d83e211312a5bba40b4afcc06d3eb40595f0baee8
-
SHA512
138b7a4e8f07d063240cdb918660682036a13dc4e518095404211c7d67ee34c0620adf344a488f5102c47bdcc68de80584dd3b83f42f35ef0d858541ade6f4d9
-
SSDEEP
768:k1/imAZfCL6p0nMskv+JUBkquxKdVC7kadRzdq2:k9imNPnMtTCTbq2
Score
10/10
Malware Config
Extracted
Family
xworm
C2
180.ip.ply.gg:48892
Mutex
QWgaicbZP6H1puz7
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Drops startup file 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\winlogin.exe"C:\Users\Admin\AppData\Local\Temp\winlogin.exe"1⤵
- Drops startup file
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB