xworm | 81358695bc67c39dab4dfcc117689e80373659b2e5fea718e4f59029c75af326 | Triage

Analysis

max time kernel
132s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08-06-2024 21:39

Sharing

Report Analysis Logs

General

Target

yeyeeey.exe
Size

33KB
MD5

8ffe64d0b5b40321adc8f39f1e23142c
SHA1

036484b6c27665b807506966d9549031116f5b83
SHA256

81358695bc67c39dab4dfcc117689e80373659b2e5fea718e4f59029c75af326
SHA512

4b13a49b52be789414e6f68dca0b1387036119d26669262ed2799b26208be51c05fc55cf8bfe055d9a6e9a053ed5f1b20e68fa69a2e663160cbec479034a1a43
SSDEEP

768:1Ua+vNohsXn42JiB706VF49jOUOjhJbJ:YvNohsn4WiR0gF49jOUOjDt

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

172.18.0.1:7000

Mutex

nIWuw5D5gw6JwMnw

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4808-1-0x0000000000BC0000-0x0000000000BCE000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

yeyeeey.exe

description pid process

Token: SeDebugPrivilege 4808 yeyeeey.exe

C:\Users\Admin\AppData\Local\Temp\yeyeeey.exe
"C:\Users\Admin\AppData\Local\Temp\yeyeeey.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4808-0-0x00007FFDAE393000-0x00007FFDAE395000-memory.dmp

Filesize
8KB

Download
memory/4808-1-0x0000000000BC0000-0x0000000000BCE000-memory.dmp

Filesize
56KB

Download
memory/4808-2-0x00007FFDAE390000-0x00007FFDAEE51000-memory.dmp

Filesize
10.8MB

Download
memory/4808-3-0x00007FFDAE390000-0x00007FFDAEE51000-memory.dmp

Filesize
10.8MB

Download