Analysis
-
max time kernel
1799s -
max time network
1801s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
25/02/2024, 15:43
General
-
Target
my_first_rat.exe
-
Size
33KB
-
MD5
3187225b20db4341a6688968ced00835
-
SHA1
1ef5354c93a49c1fc67ca40815d9c69436b92656
-
SHA256
661228edf93044850a5011990c8e2db5cba8ac56dd384e2a00d9147a6827c6e4
-
SHA512
20fe9a75f9ee30e231c33e528e23aa3fc217ef3ba40c1ae7ab15e67f25de885c61185ada3371a2120bcc9ff69f7be195cb1d0963dbf7b14ffd306e9e055f41b1
-
SSDEEP
384:xfP/SG1aTTcPTEUV75LC2TM42pfL3iB7OxVqWmRApkFXBLTsOZwpGN2v99IkuisJ:x11weF3Y42JiB70cVF49jR1Ojhubm
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
127.0.0.1:17816
8.tcp.us-cal-1.ngrok.io:17816
Mutex
ECnuEVmhYYYEOUIY
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 25 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\my_first_rat.exe"C:\Users\Admin\AppData\Local\Temp\my_first_rat.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB