Analysis
-
max time kernel
160s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
31/10/2023, 13:53
General
-
Target
33907bb0d8268011e6cfb1c3b06ad849d84efffd9dfb53ce3adda9933abe4472.exe
-
Size
98KB
-
MD5
445ad015cfea0fd3c111cd6536341bf5
-
SHA1
b4b9f4f6c65436f55fafcbcf52ebf02a676a1b9d
-
SHA256
33907bb0d8268011e6cfb1c3b06ad849d84efffd9dfb53ce3adda9933abe4472
-
SHA512
7b9b90e862f03f8745fd16749dea7e60c92e35c9d4af050bb956cb0b51a6dd65cb49296a5bdd86b8eb04b6a07cb33fa34556a259672592daf632ceca4c46cc37
-
SSDEEP
1536:K9imNPnMKTCUbq4jTTa/2w8wiV7TXxfQtnUiApKq:KoMM8CeqNcVPXxYtnSJ
Score
10/10
Malware Config
Extracted
Family
xworm
C2
194.ip.ply.gg:58713
Mutex
tRgdVZ5X7D1u4VgL
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Drops startup file 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\33907bb0d8268011e6cfb1c3b06ad849d84efffd9dfb53ce3adda9933abe4472.exe"C:\Users\Admin\AppData\Local\Temp\33907bb0d8268011e6cfb1c3b06ad849d84efffd9dfb53ce3adda9933abe4472.exe"1⤵
- Drops startup file
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB