Analysis
- max time kernel
148s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
04/06/2024, 17:15
General
- Target MainUpdated.exe
- Size 61KB
- Sample240604-vsjlwsdf9s
- SHA256 f302df05db0c085c2614de01d1f351d88b102863bebdfa6fd2cb6dbba266889c
Score
10/10
Malware Config
Extracted
Family
-
xworm
C2
-
https://pastebin.com/raw/H3wFXmEi:1234
Attributes
-
install_file
USB.exe
-
pastebin_url
https://pastebin.com/raw/H3wFXmEi
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MainUpdated.exe"C:\Users\Admin\AppData\Local\Temp\MainUpdated.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4404-0-0x00007FFEB35E3000-0x00007FFEB35E5000-memory.dmp
memory/4404-1-0x0000000000990000-0x00000000009A6000-memory.dmp
memory/4404-2-0x00007FFEB35E0000-0x00007FFEB40A1000-memory.dmp
memory/4404-3-0x00007FFEB35E3000-0x00007FFEB35E5000-memory.dmp
memory/4404-4-0x00007FFEB35E0000-0x00007FFEB40A1000-memory.dmp