Analysis
-
max time kernel
119s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
06-02-2024 14:04
General
-
Target
XClient.exe
-
Size
33KB
-
MD5
b1464f91ed72f58762070a2156a0e051
-
SHA1
24a5bda03c3a18918a3343a88f3231fdb5c5dea4
-
SHA256
be15293b42ddc2b13e6cb4316abb5a405c40f9eeb277ff0aedd284124e980298
-
SHA512
e60ace933853b192548b324ab9b2dd89a40396c6fba246ca1d251f6bdcef6a37d9484c03bed1abdab46220a99c34793445b732e807f671ddc0ebab00e6aa7046
-
SSDEEP
384:kl+PkjD9+E5MFs7iui8L7zKM42pfL3iB7OxVqWFiRApkFXBLTsOZwpGN2v99IkuV:Q+CD93W03v42JiB70SVF49jBOjhmbw
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
noiphabibi.ddns.net:1177
Mutex
uPpCa0dXygiTwFxX
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
9.9MB