Analysis
-
max time kernel
0s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
31-05-2024 12:31
Behavioral task
behavioral1
Sample
sigmasoft-0.1xw.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
sigmasoft-0.1xw.exe
Resource
win10v2004-20240508-en
14 signatures
150 seconds
General
-
Target
sigmasoft-0.1xw.exe
-
Size
74KB
-
MD5
c376c6af503504eba91372ebc3afb500
-
SHA1
283eeb9839d0e60fff06bae959c8f064d98e5b72
-
SHA256
1e860af19f9769079667c6537fe731cafb56211de7351df9a3b61b2818d5069a
-
SHA512
bb4b600bf8da4a8f004043c3008dd7770c479a1d453846026e6e2d983156ecdeca344d403092e67783ff798e2610a0584117fb707e3406e678f231319d1c59f1
-
SSDEEP
1536:uo5HV2sDLBulJl38yGzD+b8LoSK/A6iHzOFZPrUP:JYmS38y2D+b8EGzOFZS
Malware Config
Extracted
Family
xworm
C2
never-knowledge.gl.at.ply.gg:4759
Attributes
-
Install_directory
%ProgramData%
-
install_file
svchost.exe
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2024-1-0x0000000000E00000-0x0000000000E18000-memory.dmp family_xworm -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
sigmasoft-0.1xw.exedescription pid process Token: SeDebugPrivilege 2024 sigmasoft-0.1xw.exe