Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
09-01-2024 18:53
General
-
Target
b46dbf808c2ebb31c7c25f239f2d0eda5a4474341940e3fdb15d92ba945bf1a4exe.exe
-
Size
47KB
-
MD5
9cd62c1fb51533c1f12a7403e908e73b
-
SHA1
06f6702cc0ec58ee66d91c876edcb176cc07199a
-
SHA256
b46dbf808c2ebb31c7c25f239f2d0eda5a4474341940e3fdb15d92ba945bf1a4
-
SHA512
1087b0d2987ad4662aef5b6ec555544662d543127a3617f8e7afb709d8bcfc4d7ff99cec1513ad0d0a76e2caca7039cf4232da5f2217d41bbfb58fd8cd036078
-
SSDEEP
768:wecbl/b3EMYAoRM5uBFE9RfOqh3bqo5dcWZ635LhlEDSQS:vcx/54FE9RfOqJ2o5d9Z635LhlEDSQS
Score
10/10
Malware Config
Extracted
Family
xworm
Version
3.1
Mutex
kJNeDE0jriPTSPR9
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b46dbf808c2ebb31c7c25f239f2d0eda5a4474341940e3fdb15d92ba945bf1a4exe.exe"C:\Users\Admin\AppData\Local\Temp\b46dbf808c2ebb31c7c25f239f2d0eda5a4474341940e3fdb15d92ba945bf1a4exe.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB