xworm | 81358695bc67c39dab4dfcc117689e80373659b2e5fea718e4f59029c75af326 | Triage

Analysis

max time kernel
48s
max time network
49s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
08-06-2024 21:40

Sharing

Report Analysis Logs

General

Target

2456789.exe
Size

33KB
MD5

8ffe64d0b5b40321adc8f39f1e23142c
SHA1

036484b6c27665b807506966d9549031116f5b83
SHA256

81358695bc67c39dab4dfcc117689e80373659b2e5fea718e4f59029c75af326
SHA512

4b13a49b52be789414e6f68dca0b1387036119d26669262ed2799b26208be51c05fc55cf8bfe055d9a6e9a053ed5f1b20e68fa69a2e663160cbec479034a1a43
SSDEEP

768:1Ua+vNohsXn42JiB706VF49jOUOjhJbJ:YvNohsn4WiR0gF49jOUOjDt

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

172.18.0.1:7000

Mutex

nIWuw5D5gw6JwMnw

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/568-1-0x00000000006F0000-0x00000000006FE000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2456789.exe

description pid process

Token: SeDebugPrivilege 568 2456789.exe

C:\Users\Admin\AppData\Local\Temp\2456789.exe
"C:\Users\Admin\AppData\Local\Temp\2456789.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/568-0-0x00007FFFAE693000-0x00007FFFAE695000-memory.dmp

Filesize
8KB

Download
memory/568-1-0x00000000006F0000-0x00000000006FE000-memory.dmp

Filesize
56KB

Download
memory/568-2-0x00007FFFAE690000-0x00007FFFAF152000-memory.dmp

Filesize
10.8MB

Download
memory/568-3-0x00007FFFAE690000-0x00007FFFAF152000-memory.dmp

Filesize
10.8MB

Download