Analysis
-
max time kernel
1824s -
max time network
1838s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
04/11/2023, 19:09
General
-
Target
KRAKEN_RP.exe
-
Size
30KB
-
MD5
6874b72f8f12263a54a4ce6585fb1b5d
-
SHA1
daff69eeb3691fbbeff4173f64899d5cb354c424
-
SHA256
e2c991c0df0233379035ae395a00ce837cc8cdbbce1055f6267c97e6bd0570c9
-
SHA512
d8ef4b5a48b17d322681da7307d7a4b3b249f5e2ca0fe9d3b6a78b61ce10d0bf01466c1b8b9c22c2548745fb3eeb342adab3cd8cae391a62fb431f5e0351e04c
-
SSDEEP
384:f7wTA+5OfhxeelKn4MPLZhspJAXlYECwai5AsbRugtFuBLTIOZw/WVwvn9IkVu2c:3Fx7s4EQq1YETDWsbBFR9RhOqhQbF
Score
10/10
Malware Config
Extracted
Family
xworm
Version
3.0
C2
menu-webcam.gl.at.ply.gg:15905
Mutex
8z0cS3i18RmUbpz6
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\KRAKEN_RP.exe"C:\Users\Admin\AppData\Local\Temp\KRAKEN_RP.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB