Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/04/2024, 13:14

General

  • Target

    a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe

  • Size

    455KB

  • MD5

    c8d9593196962fa5d706a207c16674cd

  • SHA1

    686a8e674e6615d5cd91f7b2cba0c755054b3f69

  • SHA256

    a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d

  • SHA512

    5ddae80780c6091bfe0ab5e29bc63732c08ce34f677fc341366dcecf6db9e1bd2e0ed24cfe57eface0d19c6f46010f47eb2d74888b91a503dae00651c4a756bf

  • SSDEEP

    12288:XcTpGLwWpFGIWFfDtaY4S0LEy7w0iymL/:XOpEwiFYxsEyHiyK

Score
10/10

Malware Config

Extracted

Family

xworm

Version

5.1

C2

104.194.9.116:7000

Mutex

bUezpCDHVjUVS3W9

Attributes
  • install_file

    USB.exe

  • telegram

    https://api.telegram.org/bot6330888131:AAE5ycZdHuNqV5SVYhHeCfRENn6GuCjwXjs/sendMessage?chat_id=1046049845

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe
    "C:\Users\Admin\AppData\Local\Temp\a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5088
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5012

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/5012-7-0x00000000744F0000-0x0000000074CA0000-memory.dmp

          Filesize

          7.7MB

        • memory/5012-13-0x0000000005120000-0x0000000005130000-memory.dmp

          Filesize

          64KB

        • memory/5012-12-0x00000000744F0000-0x0000000074CA0000-memory.dmp

          Filesize

          7.7MB

        • memory/5012-11-0x0000000005120000-0x0000000005130000-memory.dmp

          Filesize

          64KB

        • memory/5012-10-0x0000000004FC0000-0x0000000005026000-memory.dmp

          Filesize

          408KB

        • memory/5012-8-0x0000000004F20000-0x0000000004FBC000-memory.dmp

          Filesize

          624KB

        • memory/5012-6-0x0000000000400000-0x000000000040E000-memory.dmp

          Filesize

          56KB

        • memory/5088-3-0x00000273FEB80000-0x00000273FEBF6000-memory.dmp

          Filesize

          472KB

        • memory/5088-5-0x0000027398040000-0x00000273980A4000-memory.dmp

          Filesize

          400KB

        • memory/5088-9-0x00007FFF6BF00000-0x00007FFF6C9C1000-memory.dmp

          Filesize

          10.8MB

        • memory/5088-4-0x00000273FE830000-0x00000273FE84E000-memory.dmp

          Filesize

          120KB

        • memory/5088-0-0x00000273FC3F0000-0x00000273FC406000-memory.dmp

          Filesize

          88KB

        • memory/5088-2-0x00000273FE9F0000-0x00000273FEA00000-memory.dmp

          Filesize

          64KB

        • memory/5088-1-0x00007FFF6BF00000-0x00007FFF6C9C1000-memory.dmp

          Filesize

          10.8MB