Analysis
-
max time kernel
118s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
28-03-2024 09:24
General
-
Target
SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe
-
Size
455KB
-
MD5
c8d9593196962fa5d706a207c16674cd
-
SHA1
686a8e674e6615d5cd91f7b2cba0c755054b3f69
-
SHA256
a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d
-
SHA512
5ddae80780c6091bfe0ab5e29bc63732c08ce34f677fc341366dcecf6db9e1bd2e0ed24cfe57eface0d19c6f46010f47eb2d74888b91a503dae00651c4a756bf
-
SSDEEP
12288:XcTpGLwWpFGIWFfDtaY4S0LEy7w0iymL/:XOpEwiFYxsEyHiyK
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.1
C2
104.194.9.116:7000
Mutex
bUezpCDHVjUVS3W9
Attributes
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot6330888131:AAE5ycZdHuNqV5SVYhHeCfRENn6GuCjwXjs/sendMessage?chat_id=1046049845
aes.plain
Signatures
-
Detect Xworm Payload 5 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 31 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2004 -s 7362⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
400KB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
6.9MB