Analysis
-
max time kernel
295s -
max time network
300s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
28/03/2024, 17:40
General
-
Target
XClient.exe
-
Size
61KB
-
MD5
5652e7ea9948e48573e870919424f08e
-
SHA1
a857d8ddfdbe3a60ec9e05e1e77ba2819829bd3e
-
SHA256
b06e15fcb1c504a00f2a4b5dc8ba361d92535fe66d51b7b66ee2426ece1c6e46
-
SHA512
bc013e22f04ca149196801ef74bc4da333b1bc4521eed1707532d602c90d7a30515adf16f8cddadfc179045d2c8665bc074eeb7b4f6a4b0d920f69631a98a9e2
-
SSDEEP
1536:+0wHa+OYQjTpo3F5rkbL68XXdBPoQcC9OH1970:+thQjw5rkbLzndNOHA
Malware Config
Extracted
Family
xworm
C2
127.0.0.1:5004
Attributes
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/4988-0-0x00000000005A0000-0x00000000005B6000-memory.dmp family_xworm -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4988 XClient.exe