Analysis
-
max time kernel
3s -
max time network
30s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
-
submitted
07-01-2024 18:58
General
-
Target
Synapse X.exe
-
Size
39KB
-
MD5
dc4d4769d663fbf00bfe6d0e83f5f0ec
-
SHA1
bfb1de87f74d835aef883d131b5f12f7bc2db549
-
SHA256
1c4ce5bfffdd71630d23fe0cfbf1217d8b195db9899d2ca53ee1c89b0b25caa1
-
SHA512
efae356790fe1dfe557e6709b8f6b541b4cb43844735d9bd866f8f8e579e37342e69258b663cc1c08144c6fd10006b5b7482d6855711b85417ab9281c6286cc2
-
SSDEEP
768:0Q46ubAL+1XrjW6vXPcCQgoyfccJY2sJvo80F5Pi9j/k67OMhF3trQ:f46ubHXrjdPcCQzyBJY2cCF497k67OMS
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
Mutex
TcK6iKFmjhETcMYi
Attributes
-
install_file
USB.exe
-
pastebin_url
https://pastebin.com/raw/RqgnZ1zk
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Synapse X.exe'2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Synapse X.exe'2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
472KB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
64KB