Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
21-05-2024 00:38
General
-
Target
848411659aa8dfc757a3f4a889ed7c2b7f2c0e78c119bec00cd31bf32925bcc7.exe
-
Size
225KB
-
MD5
caba3480869729c3082340ab4ce4dfc0
-
SHA1
452e7dbd1aae2ede9d989b9018af83185e27097b
-
SHA256
848411659aa8dfc757a3f4a889ed7c2b7f2c0e78c119bec00cd31bf32925bcc7
-
SHA512
a08ba586dc9f804dc8afaff992ddc7c8af66acbaedaaeb0bbae36d8b0c96e788e7c747633d6aa345097831db146d5708e56ccfdf2287e9e9baf9b9966a256791
-
SSDEEP
6144:cqrGcKnbsH9UhcX7elbKTua9bfF/H9d9n:cJcRH93X3u+
Score
10/10
Malware Config
Extracted
Family
xworm
C2
key-metro.gl.at.ply.gg:53838
Attributes
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\848411659aa8dfc757a3f4a889ed7c2b7f2c0e78c119bec00cd31bf32925bcc7.exe"C:\Users\Admin\AppData\Local\Temp\848411659aa8dfc757a3f4a889ed7c2b7f2c0e78c119bec00cd31bf32925bcc7.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2448-0-0x0000000000AA0000-0x0000000000ADE000-memory.dmpFilesize
248KB
-
memory/2448-1-0x00007FFC40BD3000-0x00007FFC40BD5000-memory.dmpFilesize
8KB
-
memory/2448-2-0x00007FFC40BD0000-0x00007FFC41691000-memory.dmpFilesize
10.8MB
-
memory/2448-3-0x00007FFC40BD3000-0x00007FFC40BD5000-memory.dmpFilesize
8KB
-
memory/2448-4-0x00007FFC40BD0000-0x00007FFC41691000-memory.dmpFilesize
10.8MB