Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
09-06-2024 04:01
General
-
Target
884df6eceba6d2ce19b3994945d37fd2487a012c64345939d9398f6001bf4e51.exe
-
Size
2.2MB
-
MD5
d46c0c68803203f7db45a78a0e02225f
-
SHA1
9d198155dd59799ffd16397243b5047d7208800a
-
SHA256
884df6eceba6d2ce19b3994945d37fd2487a012c64345939d9398f6001bf4e51
-
SHA512
3811e601f7dab65bbd8c4b63cb91355b5da16de4528f8f14a941aa73f7bd973876dfd7aab5606d27bfcb9c0e7584317d8337151500d777e4fe455df090e56085
-
SSDEEP
12288:tOnWCm5n3D7ofordCP4MmT9cFTf7GvgV1JQ5mc7h9bSe/zMn:
Score
10/10
Malware Config
Extracted
Family
xworm
Version
3.1
C2
adult-purchased.gl.at.ply.gg:13795
Mutex
SDsGs8jdu1MveW6y
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF 1 IoCs
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
-
Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\884df6eceba6d2ce19b3994945d37fd2487a012c64345939d9398f6001bf4e51.exe"C:\Users\Admin\AppData\Local\Temp\884df6eceba6d2ce19b3994945d37fd2487a012c64345939d9398f6001bf4e51.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.2MB
-
Filesize
56KB
-
Filesize
832KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB