Analysis
-
max time kernel
145s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
13-10-2023 02:59
General
-
Target
payload.dll
-
Size
300.0MB
-
MD5
3ba404b551a241dfb984735c87622741
-
SHA1
1b2a4cbdacf4f33c8f863d557744bb18ba8485f6
-
SHA256
b4717d4c65dc8d69d33ac0dc7d3f7608637a420cd3454f4eec0a2238d83327d4
-
SHA512
3ec6d0ab748c0920d42def7e722847fefc6466142f8221589d14111311726ceb015f0ef60bb4bc8b086f5e6cd5073e6c8a2fb4f8dd8003121c5216a944430b21
-
SSDEEP
6144:iA+z1A+PNVjAyk6GEmmF/aKCH+MuzMy4:mAGkbFt+
Score
10/10
Malware Config
Extracted
Family
xworm
Version
3.1
C2
mikexwormxxxyy.ddns.net:7000
Mutex
ir1SigksGA3TjceN
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 2 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\payload.dll1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\notepad.exenotepad.exe2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
-
Filesize
72KB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB