Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
19-04-2024 16:54
General
-
Target
0ba64202181094b72f8db073c627de074bd18ef9f977d42e12de6d6478ff283d.exe
-
Size
37KB
-
MD5
ffc433cc5b446ea470c8ce98edd7c248
-
SHA1
90248c2c85885af789ca75053438c77c7512fbac
-
SHA256
0ba64202181094b72f8db073c627de074bd18ef9f977d42e12de6d6478ff283d
-
SHA512
0b085028dabe75bb22480b75191555dcfbf53c6caccd097375c632f34c47fb49ab4c24d2d4db7f6ffeb00b12184b2d433b70d00d86615485e7f7f76a52547a94
-
SSDEEP
384:xeOSrHiWIjrdTadLwxwCUOCFFniFyNd9jMJrqpkFE+LT/OZwEci2v99Ik1is+Pja:HrtcCSFniFyh2dFh9gjO1h1qVgXj
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
137.184.9.205:7000
Mutex
bV5QPxwLtEpuTDDi
Attributes
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot6567817661:AAEPVH8mr4mtxVjaqzlho_8xxGuixiJIukE
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ba64202181094b72f8db073c627de074bd18ef9f977d42e12de6d6478ff283d.exe"C:\Users\Admin\AppData\Local\Temp\0ba64202181094b72f8db073c627de074bd18ef9f977d42e12de6d6478ff283d.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
512KB