Analysis
-
max time kernel
4s -
max time network
31s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
-
submitted
07-01-2024 18:58
General
-
Target
XClient.exe
-
Size
190KB
-
MD5
2d76fcb9deef6e4852632fc9a44ab454
-
SHA1
10dcb76c496fea1fc4923cde0d4b021603aba861
-
SHA256
d399b506ff21aec0263be59b24c2ef97fa0b220257b4290f836ccbbde2bcc5bd
-
SHA512
c3ea002917266b0858b5a3732ac5df8ed016699eb4a058e15fcc2bf658628b601f3003593f49b5197b7d388f66eec04da963935e47a58e359bda8aacdd3748c7
-
SSDEEP
3072:asZOqILP2psn3+bjTOdnp0RUGKXs+S++7KFSbxeY+qDDrMP:xUqJUObeGqStKEbxI
Score
10/10
Malware Config
Extracted
Family
xworm
C2
tr1.localto.net:39186
Attributes
-
Install_directory
%ProgramData%
-
install_file
Microsoft Storge.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Microsoft Storge" /tr "C:\ProgramData\Microsoft Storge.exe"2⤵
- Creates scheduled task(s)
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208KB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
64KB