Analysis
-
max time kernel
3s -
max time network
28s -
platform
windows10-1703_x64 -
resource
win10-20231220-en -
resource tags
-
submitted
14/02/2024, 08:00
General
-
Target
XClient.exe
-
Size
62KB
-
MD5
9e4813d75526cac0c2e2b0c83708005f
-
SHA1
0a2ce1e892ef1277c675c2bd27bb6dc57c3dff89
-
SHA256
5fa6d446a704170d0b73d9051f73beb2f3d24fded918c9d92dd859ed568f7752
-
SHA512
c854ca94e11a7f3cb778d789321e185239d3110de63aef9e0d56840c74dc591ab0c17458d1dd0a57936085b1ee9c26a44f8eaf96c6e85d708f7e989add6e9494
-
SSDEEP
1536:xhXczwej3pVgFXIX4BbyaFPKdXNKprjOD5LBvMTzW:xhszLj0F84Bby+2WHOFLQW
Score
10/10
Malware Config
Extracted
Family
xworm
C2
127.0.0.1:63389
192.168.8.117:63389
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
64KB