Analysis
-
max time kernel
135s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 17:01
Behavioral task
behavioral1
Sample
44305bb8e277b9f7ae66a2e99a5173203366817e2ae6d5bf102bb3b6ca7c8518.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
44305bb8e277b9f7ae66a2e99a5173203366817e2ae6d5bf102bb3b6ca7c8518.exe
-
Size
33KB
-
MD5
43262d9ba2f21646f060f4b4fe5e778b
-
SHA1
bf475f07e81720fd1e52002764821ad2a84f36eb
-
SHA256
44305bb8e277b9f7ae66a2e99a5173203366817e2ae6d5bf102bb3b6ca7c8518
-
SHA512
d26bb24c6d2e083091f2e30b5b2f2adc60cb0b3504d0c46e038fbc35dcfed0f9243171bb9e808c4ddc4a3e0f225615b3fd871777997e5be72d096231e8dccdd1
-
SSDEEP
768:5MXta8q7wYEfUak1JhyF2G95bDJuOMhK/+1l:5MXtQ7RvakDgFj95bcOM+Cl
Malware Config
Extracted
Family
xworm
Version
3.1
C2
zafa02.hopto.org:4545
Mutex
4tFixBcpe8fBC07n
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4340-0-0x0000000000F40000-0x0000000000F4E000-memory.dmp family_xworm -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
44305bb8e277b9f7ae66a2e99a5173203366817e2ae6d5bf102bb3b6ca7c8518.exepid process 4340 44305bb8e277b9f7ae66a2e99a5173203366817e2ae6d5bf102bb3b6ca7c8518.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
44305bb8e277b9f7ae66a2e99a5173203366817e2ae6d5bf102bb3b6ca7c8518.exedescription pid process Token: SeDebugPrivilege 4340 44305bb8e277b9f7ae66a2e99a5173203366817e2ae6d5bf102bb3b6ca7c8518.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\44305bb8e277b9f7ae66a2e99a5173203366817e2ae6d5bf102bb3b6ca7c8518.exe"C:\Users\Admin\AppData\Local\Temp\44305bb8e277b9f7ae66a2e99a5173203366817e2ae6d5bf102bb3b6ca7c8518.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4340-0-0x0000000000F40000-0x0000000000F4E000-memory.dmpFilesize
56KB
-
memory/4340-1-0x00007FFD7D5F3000-0x00007FFD7D5F5000-memory.dmpFilesize
8KB
-
memory/4340-2-0x00007FFD7D5F0000-0x00007FFD7E0B1000-memory.dmpFilesize
10.8MB
-
memory/4340-3-0x00007FFD7D5F3000-0x00007FFD7D5F5000-memory.dmpFilesize
8KB
-
memory/4340-4-0x00007FFD7D5F0000-0x00007FFD7E0B1000-memory.dmpFilesize
10.8MB