Analysis
-
max time kernel
459s -
max time network
508s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
21-04-2024 20:48
General
-
Target
XClient.exe
-
Size
33KB
-
MD5
d9887dc500103e33a0f65ee4e3a74a73
-
SHA1
25919df3eaed1f589e6d5693a4be98a93ca55420
-
SHA256
d8e8574070b46cb5ec63d41a89012f6910e19172b05c51b35a930fbe4ef0a75d
-
SHA512
cdf8a42ccc2d45e00a3545c2a61b8ff662e52f1b634298c7fd99f7b5b9ad1aed4776a2db4439ef8e565c5c034c67ffc334cf2858e19b6447dd9751809eba83ee
-
SSDEEP
768:KUa+vNohsXn42JiB70wVF49j/FbOjhlby:hvNohsn4WiR06F49j/lOjnW
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
87.121.105.227:7000
Mutex
fg6y5VZ2fwQckTwB
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
48KB
-
Filesize
10.8MB
-
Filesize
64KB