Analysis

  • max time kernel
    145s
  • max time network
    136s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    28/03/2024, 18:09

General

  • Target

    dwadwad.exe

  • Size

    58KB

  • MD5

    4686610c1cc1e2f6b8072f19e3548933

  • SHA1

    397bb3e7818b4bdb636014d245de57ef6f2cce1f

  • SHA256

    204abc4aea91028a458dda1122ab8cc4d4ea9615d31d3a19c923b38f87240525

  • SHA512

    2a30197e4958bfae278a1d07f43ed84d4d1f17571d96f9987d02dc601dda028cfc46d25b3c08c8eae49aa7a0b5cb6c3616a6fac62c336a87d82ebe2af9d94c3e

  • SSDEEP

    1536:G1PraqE7SEWvkgKDuIakbiREYXpnOmRCwF:GFrtEGElxmkbivnOmRCY

Score
10/10

Malware Config

Extracted

Family

xworm

C2

192.168.0.1:5004:5004

Attributes
  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dwadwad.exe
    "C:\Users\Admin\AppData\Local\Temp\dwadwad.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3140

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3140-0-0x0000000000290000-0x00000000002A4000-memory.dmp

          Filesize

          80KB

        • memory/3140-1-0x00007FFC5B590000-0x00007FFC5BF7C000-memory.dmp

          Filesize

          9.9MB

        • memory/3140-2-0x000000001AFE0000-0x000000001AFF0000-memory.dmp

          Filesize

          64KB

        • memory/3140-3-0x00007FFC5B590000-0x00007FFC5BF7C000-memory.dmp

          Filesize

          9.9MB

        • memory/3140-4-0x000000001AFE0000-0x000000001AFF0000-memory.dmp

          Filesize

          64KB