Analysis
-
max time kernel
64s -
max time network
69s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2024, 19:18
Behavioral task
behavioral1
Sample
XBN.exe
Resource
win7-20240221-en
4 signatures
150 seconds
General
-
Target
XBN.exe
-
Size
86KB
-
MD5
7d2f209505446a983e351cc4ae9065ff
-
SHA1
f180d9f5704bd01d0d9498ad6f6ec4bff7565c65
-
SHA256
dab6c1af2a7c4dc1ea1b4b163b1e53657502cb347df28e265874b635aaa49f3e
-
SHA512
ead7917c923f1c639443ce09efa4ffe3e0a400184bc57a4d693cdb804d2612badc4cc8c6b8edda97a1b857534b30dfdd59bf886676bea68801fc155187fcc45f
-
SSDEEP
1536:j9z1G4KstzBVZC56iqr/bwIdDq0wX/5A63pehdD1ROXqTJKv1:lETgBjX/bwgJiFIrD1ROXqTU1
Malware Config
Extracted
Family
xworm
C2
18.ip.gl.ply.gg:7988
Attributes
-
Install_directory
%AppData%
-
install_file
svchost.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral2/memory/4596-0-0x00000000003B0000-0x00000000003CC000-memory.dmp family_xworm -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 18 ip-api.com -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4596 XBN.exe