Resubmissions
08/06/2024, 18:20
240608-wyz2hafb421008/06/2024, 18:17
240608-ww7cssec5w1008/06/2024, 18:11
240608-ws439seb9v1019/05/2024, 22:52
240519-2txcpsfe7w19/05/2024, 22:48
240519-2rh3asfb6210Analysis
- max time kernel
90s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
08/06/2024, 18:11
General
- Target XWorm-Rat-Remote-Administration-Tool--main/XWorm-RAT-V2.1-builder.exe
- Size 3.2MB
- Sample240608-ws439seb9v
- SHA256 b6fb77dfd00695678b06ed122523a0b067077fe69113f395661cd3be748d9f7c
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWorm-Rat-Remote-Administration-Tool--main\XWorm-RAT-V2.1-builder.exe"C:\Users\Admin\AppData\Local\Temp\XWorm-Rat-Remote-Administration-Tool--main\XWorm-RAT-V2.1-builder.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2320-1-0x0000020D883F0000-0x0000020D8872E000-memory.dmp
memory/2320-0-0x00007FFFEF2C3000-0x00007FFFEF2C5000-memory.dmp
memory/2320-2-0x0000020D8A3A0000-0x0000020D8A3C0000-memory.dmp
memory/2320-3-0x00007FFFEF2C0000-0x00007FFFEFD81000-memory.dmp
memory/2320-4-0x0000020DA2B30000-0x0000020DA2B3A000-memory.dmp
memory/2320-5-0x00007FFFEF2C0000-0x00007FFFEFD81000-memory.dmp