Analysis
- max time kernel
145s - max time network
150s - platform
windows7_x64 - resource
win7-20231023-en - resource tags
- submitted
21/11/2023, 04:50
General
- Target xuKxxBO9y1gH.exe
- Size 30KB
- Sample231121-ff9j8acd33
- SHA256 575beebf842e93360ca595466fa746178421d969bba68868f0900f14769a1a32
Score
10/10
Malware Config
Extracted
Family
-
xworm
Version
-
3.1
C2
-
0.tcp.sa.ngrok.io:18384
Mutex
-
exSTHb25eUIigLYq
Attributes
-
install_file
123.exe
aes.plain
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\xuKxxBO9y1gH.exe"C:\Users\Admin\AppData\Local\Temp\xuKxxBO9y1gH.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2080-0-0x0000000001070000-0x000000000107E000-memory.dmp
memory/2080-1-0x000007FEF5080000-0x000007FEF5A6C000-memory.dmp
memory/2080-2-0x000000001AFA0000-0x000000001B020000-memory.dmp
memory/2080-3-0x000007FEF5080000-0x000007FEF5A6C000-memory.dmp
memory/2080-4-0x000000001AFA0000-0x000000001B020000-memory.dmp