Resubmissions
08/06/2024, 18:20
240608-wyz2hafb421008/06/2024, 18:17
240608-ww7cssec5w1008/06/2024, 18:11
240608-ws439seb9v1019/05/2024, 22:52
240519-2txcpsfe7w19/05/2024, 22:48
240519-2rh3asfb6210Analysis
- max time kernel
92s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
08/06/2024, 18:11
General
- Target XWorm-Rat-Remote-Administration-Tool--main/DisAsClaimer.exe
- Size 12KB
- Sample240608-ws439seb9v
- SHA256 1ac4832667db7044b1077e447d587a14dcd1270e71b8d34157a77d515b61c4b3
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWorm-Rat-Remote-Administration-Tool--main\DisAsClaimer.exe"C:\Users\Admin\AppData\Local\Temp\XWorm-Rat-Remote-Administration-Tool--main\DisAsClaimer.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_hfjopan0.u3g.ps1
memory/4428-0-0x00007FFE0DAC3000-0x00007FFE0DAC5000-memory.dmp
memory/4428-1-0x0000000000A60000-0x0000000000A68000-memory.dmp
memory/4428-11-0x000000001B5B0000-0x000000001B5D2000-memory.dmp
memory/4428-12-0x00007FFE0DAC0000-0x00007FFE0E581000-memory.dmp
memory/4428-14-0x00007FFE0DAC0000-0x00007FFE0E581000-memory.dmp