Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
10-04-2024 02:09
Behavioral task
behavioral1
Sample
XWorm V5.3.exe
Resource
win11-20240221-en
2 signatures
150 seconds
General
-
Target
XWorm V5.3.exe
-
Size
25.0MB
-
MD5
c0b4c6349df031081dd6aee3f25a1c9b
-
SHA1
82f164fdff783d2a02ae6db9e6d71d4c40a8acf7
-
SHA256
f13c9eb085bec9239557753ab617404e60a035422194550fb56c2df96bf00670
-
SHA512
63a18a2d0d894946d32a97f2e2112509b0ad54b4d5e4c04123c1c278f35669a909588d0d3036a054d544eedc6aa3025b8edd1560950e45749ee9f2db2277f69b
-
SSDEEP
393216:KU25uLx3D9Pp9HlzCDjXW4ReN1RwdtKqSPg5898ELJX88BBYUK5TzRMxwMMbNJNT:KsxP3F+30MPSP9FJXxKJoMbB
Score
7/10
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/2404-1-0x0000028174500000-0x0000028177778000-memory.dmp agile_net -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
XWorm V5.3.exepid process 2404 XWorm V5.3.exe