Analysis
-
max time kernel
118s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
12/10/2023, 15:02
General
-
Target
download1_JC.exe
-
Size
40KB
-
MD5
358e5b1466b74932897a1a20230ab58a
-
SHA1
505829777611a7ff257cfe1b0462394a97cad0a6
-
SHA256
038806df1542419d8fff8f288bc2159a80c0a1c8f62e3df7c426bfd985b3d1d2
-
SHA512
237802ed63e0de8f23adfeb09b240a3bdec9f3704fa724480a70cf8ecd05e368202ea5cdd22e9d0d9a0649b8c19182e7032741c0a7fd51cd776a59bd7888cd40
-
SSDEEP
768:qGEsTZG4mvNq420kSRs0RpPvpsQhLOFuekk:fIqAdPh1OEekk
Score
10/10
Malware Config
Extracted
Family
xworm
Version
2.2
C2
xyoptotway.work.gd:7998
Mutex
zRvvAJhG8tAf4cXE
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\download1_JC.exe"C:\Users\Admin\AppData\Local\Temp\download1_JC.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
512KB