Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
12/04/2024, 01:45
General
- Target XWorm V5.4 VIP.exe
- Size 13.8MB
- Sample240412-b6vrjafa2s
- SHA256 3b2f28e621af3ea54abf28071e2f36143a30aa87a091f0ee3764c15b2dea4303
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWorm V5.4 VIP.exe"C:\Users\Admin\AppData\Local\Temp\XWorm V5.4 VIP.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
ogpXG.dll
memory/4872-1-0x0000020BDFBD0000-0x0000020BE09B0000-memory.dmp
memory/4872-0-0x00007FFF99D20000-0x00007FFF9A7E1000-memory.dmp
memory/4872-8-0x0000020BE2680000-0x0000020BE2690000-memory.dmp
memory/4872-9-0x0000020BFBD00000-0x0000020BFC8EE000-memory.dmp
memory/4872-10-0x0000020BFCBD0000-0x0000020BFCD3A000-memory.dmp
memory/4872-11-0x00007FFF99D20000-0x00007FFF9A7E1000-memory.dmp