Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
01-05-2024 01:36
Behavioral task
behavioral1
Sample
6f5e4c2f1acbaa248f7501e931462d3da75e6deba050065538153bfe14a6bdb5.exe
Resource
win7-20240221-en
12 signatures
150 seconds
General
-
Target
6f5e4c2f1acbaa248f7501e931462d3da75e6deba050065538153bfe14a6bdb5.exe
-
Size
32KB
-
MD5
5703edb174766786773f4b565b3ccf85
-
SHA1
c4e1aa7bf7d5bd0f6c19e8c00d2b32cca143ac19
-
SHA256
6f5e4c2f1acbaa248f7501e931462d3da75e6deba050065538153bfe14a6bdb5
-
SHA512
d1c798c43abd58163fb059c56fc5084bc3826c842076bee7b432887b8aec421a685efe7b491c5afce7bc06765565eecc75c52b6901a34d4950c31d965874a2cd
-
SSDEEP
384:aEbmX5Qa+vN1h1+X3v6JFjL+g93Tm2eaFO3xdRApkFTBLTsOZwpGd2v99Ikuis/:TVa+vNtg+PB93Tw46xdVFE9jyOjhvb/
Malware Config
Extracted
Family
xworm
Version
5.0
C2
91.92.242.85:3344
Mutex
JxfYmBE6u9bELdp4
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1112-0-0x00000000006C0000-0x00000000006CE000-memory.dmp family_xworm -
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1112-0-0x00000000006C0000-0x00000000006CE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
6f5e4c2f1acbaa248f7501e931462d3da75e6deba050065538153bfe14a6bdb5.exedescription pid process Token: SeDebugPrivilege 1112 6f5e4c2f1acbaa248f7501e931462d3da75e6deba050065538153bfe14a6bdb5.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1112-0-0x00000000006C0000-0x00000000006CE000-memory.dmpFilesize
56KB
-
memory/1112-1-0x00007FFA57FC0000-0x00007FFA58A81000-memory.dmpFilesize
10.8MB
-
memory/1112-2-0x000000001B2E0000-0x000000001B2F0000-memory.dmpFilesize
64KB
-
memory/1112-3-0x00007FFA57FC0000-0x00007FFA58A81000-memory.dmpFilesize
10.8MB
-
memory/1112-4-0x000000001B2E0000-0x000000001B2F0000-memory.dmpFilesize
64KB