Analysis
-
max time kernel
118s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
21/05/2024, 14:35
General
-
Target
f55d89f82515bde23bb272f930cb9492.exe
-
Size
36KB
-
MD5
f55d89f82515bde23bb272f930cb9492
-
SHA1
666d0f5a98f03292abf16cd2de599997c836926a
-
SHA256
4d9fb14e15d1613a7a5d70efbacb0f153729f02216116c3f7f117b033bd7655c
-
SHA512
a7a62daf90aae27207b77034e8a76d5b3f8aa05430bd8768d46be7f3843962ddc1ef154691dc0f26051605fbb36269e59f18c3c75fdf72222346188e7a6cf03b
-
SSDEEP
384:/IFAz8mqQNv9qNx7kKka/sVxCTjMBVJYX7+u91X5Lj6WmyyNApPzuSvZ5mpkFyHZ:EApN1/qEMFj60y+hLFyT9CCOjhyPy2B
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
85.203.4.146:7000
Mutex
eItTbYBfBYihwkyW
Attributes
-
Install_directory
%Userprofile%
-
install_file
svchost.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Drops startup file 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f55d89f82515bde23bb272f930cb9492.exe"C:\Users\Admin\AppData\Local\Temp\f55d89f82515bde23bb272f930cb9492.exe"1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB