Resubmissions
08/06/2024, 18:20
240608-wyz2hafb421008/06/2024, 18:17
240608-ww7cssec5w1008/06/2024, 18:11
240608-ws439seb9v1019/05/2024, 22:52
240519-2txcpsfe7w19/05/2024, 22:48
240519-2rh3asfb6210Analysis
- max time kernel
62s - max time network
64s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
19/05/2024, 22:48
General
- Target XWorm-Rat-Remote-Administration-Tool--main/XWorm-RAT-V2.1-builder.exe
- Size 3.2MB
- Sample240519-2rh3asfb62
- SHA256 b6fb77dfd00695678b06ed122523a0b067077fe69113f395661cd3be748d9f7c
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWorm-Rat-Remote-Administration-Tool--main\XWorm-RAT-V2.1-builder.exe"C:\Users\Admin\AppData\Local\Temp\XWorm-Rat-Remote-Administration-Tool--main\XWorm-RAT-V2.1-builder.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1472-0-0x00007FFB9F603000-0x00007FFB9F605000-memory.dmp
memory/1472-1-0x0000026E6D3A0000-0x0000026E6D6DE000-memory.dmp
memory/1472-2-0x0000026E6DA90000-0x0000026E6DAB0000-memory.dmp
memory/1472-3-0x00007FFB9F600000-0x00007FFBA00C1000-memory.dmp
memory/1472-4-0x0000026E6F410000-0x0000026E6F41A000-memory.dmp
memory/1472-5-0x00007FFB9F600000-0x00007FFBA00C1000-memory.dmp