Analysis

  • max time kernel
    92s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-04-2024 09:43

General

  • Target

    XWorm V5.4.exe

  • Size

    13.8MB

  • MD5

    efb0528d6978337e964d999dacb621df

  • SHA1

    244979b8495d3d173a4359d62ad771f99a0033fc

  • SHA256

    4786ac3ceb9ecdcb98bdd19a0e93750e6c9c0df460751994840f8ea9733cc491

  • SHA512

    4b16aca5638094741a9e5f0e4581b5c3cdbd77835035362468d2a0e077fba0f96b8dd98c4a4ea853b3b623d5b525fe64091daa1b761597b660840a371fbae0df

  • SSDEEP

    196608:msZttF81Wco24/vt8Kf67RQCTbJev4Z4t2WL8PSlsZA6G:mEtM1VR4cRZ0QZaL8qlsZVG

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XWorm V5.4.exe
    "C:\Users\Admin\AppData\Local\Temp\XWorm V5.4.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    PID:4068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ogpXG\ogpXG.dll

    Filesize

    112KB

    MD5

    2f1a50031dcf5c87d92e8b2491fdcea6

    SHA1

    71e2aaa2d1bb7dbe32a00e1d01d744830ecce08f

    SHA256

    47578a37901c82f66e4dba47acd5c3cab6d09c9911d16f5ad0413275342147ed

    SHA512

    1c66dbe1320c1a84023bdf77686a2a7ab79a3e86ba5a4ea2cda9a37f8a916137d5cfec30b28ceae181355f6f279270465ef63ae90b7e8dcd4c1a8198a7fd36a8

  • memory/4068-0-0x00007FFC1E080000-0x00007FFC1EB41000-memory.dmp

    Filesize

    10.8MB

  • memory/4068-1-0x000001CB8E8B0000-0x000001CB8F690000-memory.dmp

    Filesize

    13.9MB

  • memory/4068-8-0x000001CBAAC10000-0x000001CBAAC20000-memory.dmp

    Filesize

    64KB

  • memory/4068-9-0x000001CBAAC20000-0x000001CBAB80E000-memory.dmp

    Filesize

    11.9MB

  • memory/4068-10-0x00007FFC1E080000-0x00007FFC1EB41000-memory.dmp

    Filesize

    10.8MB