Analysis

  • max time kernel
    13s
  • max time network
    17s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-04-2024 14:13

General

  • Target

    XWorm V5.0.exe

  • Size

    10.4MB

  • MD5

    227494b22a4ee99f48a269c362fd5f19

  • SHA1

    d32d08cf93d7f9450aee7e1e6c39d9d83b9a35c9

  • SHA256

    7471ff7818da2e044caf5bd89725b6283ed0304453c18a0490d6341f3a010ca2

  • SHA512

    71070e6b8042fa262ce12721e6c09104aec0a61ac0d6022f59f838077109b9476a5c1f8409242d93888eff6d36f0ee76337481fefe6f05e0f1243efbf350bee0

  • SSDEEP

    196608:z59nhcOWSxxgQHl2np1eY5J5itQaZWtU8i/MJ:zRRWQBQnpji1W+8i/

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XWorm V5.0.exe
    "C:\Users\Admin\AppData\Local\Temp\XWorm V5.0.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    PID:3972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\CE8806DA1EF0F1BB553DFF4FC5E9FCCD\CE8806DA1EF0F1BB553DFF4FC5E9FCCD.dll

    Filesize

    112KB

    MD5

    a239b7cac8be034a23e7e231d3bcc6df

    SHA1

    ae3c239a17c2b4b4d2fba1ec862cf9644bf1346d

    SHA256

    063099408fd5fb10a7ea408a50b7fb5da1c36accc03b9b31c933df54385d32b8

    SHA512

    c79a2b08f7e95d49a588b1f41368f0dd8d4cd431ad3403301e4d30826d3df0907d01b28ef83116ad6f035218f06dbdf63a0f4f2f9130bba1b0b7e58f9fc67524

  • memory/3972-0-0x00007FFD39670000-0x00007FFD3A131000-memory.dmp

    Filesize

    10.8MB

  • memory/3972-1-0x000002292A0A0000-0x000002292AB12000-memory.dmp

    Filesize

    10.4MB

  • memory/3972-8-0x000002292C830000-0x000002292C840000-memory.dmp

    Filesize

    64KB

  • memory/3972-9-0x00000229457E0000-0x0000022946396000-memory.dmp

    Filesize

    11.7MB

  • memory/3972-10-0x00000229465D0000-0x000002294673A000-memory.dmp

    Filesize

    1.4MB

  • memory/3972-11-0x00007FFD39670000-0x00007FFD3A131000-memory.dmp

    Filesize

    10.8MB