Analysis
- max time kernel
145s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20231023-en - resource tags
- submitted
21/11/2023, 04:50
General
- Target xuKxxBO9y1gH.exe
- Size 30KB
- Sample231121-ff9j8acd33
- SHA256 575beebf842e93360ca595466fa746178421d969bba68868f0900f14769a1a32
Malware Config
Extracted
-
xworm
-
3.1
-
0.tcp.sa.ngrok.io:18384
-
exSTHb25eUIigLYq
-
install_file
123.exe
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\xuKxxBO9y1gH.exe"C:\Users\Admin\AppData\Local\Temp\xuKxxBO9y1gH.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2704-0-0x00000000007C0000-0x00000000007CE000-memory.dmp
memory/2704-1-0x00007FFAA4E10000-0x00007FFAA58D1000-memory.dmp
memory/2704-2-0x000000001B6D0000-0x000000001B6E0000-memory.dmp
memory/2704-3-0x00007FFAA4E10000-0x00007FFAA58D1000-memory.dmp
memory/2704-4-0x000000001B6D0000-0x000000001B6E0000-memory.dmp
memory/4224-5-0x000001EB91A90000-0x000001EB91AA0000-memory.dmp
memory/4224-21-0x000001EB91B90000-0x000001EB91BA0000-memory.dmp
memory/4224-37-0x000001EB99F00000-0x000001EB99F01000-memory.dmp
memory/4224-39-0x000001EB99F30000-0x000001EB99F31000-memory.dmp
memory/4224-40-0x000001EB99F30000-0x000001EB99F31000-memory.dmp
memory/4224-41-0x000001EB9A040000-0x000001EB9A041000-memory.dmp