xworm | 5d95c0868fefe2bf2ac14a5c09f455fb459d3b68da392f499ae60679c122bfcf

Analysis

max time kernel
127s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-06-2024 01:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d95c0868fefe2bf2ac14a5c09f455fb459d3b68da392f499ae60679c122bfcf.exe
Size

127KB
MD5

d44a834df64cc1d785cf3b34d0e7ed53
SHA1

69b26d8dbbb7ecc2b8ff2263ba5577b3689fd576
SHA256

5d95c0868fefe2bf2ac14a5c09f455fb459d3b68da392f499ae60679c122bfcf
SHA512

138802b217ec682e2cd7b9117e1456f89469f67475d99776cdf86f940f40caf060a3e5bdf7666940ed443350f919fd399e6eb8f7ff4e3a056d07b7c98cdfc5ae
SSDEEP

3072:i44FE9R/Oq6Bz65/M6If+3Js+3JFkKeTnc:ivE9kxBt25

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

3.1

185.91.127.220:7000

Mutex

0liuzqSbSYrrf5nM

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3244-0-0x0000000000C40000-0x0000000000C66000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral2/memory/3244-0-0x0000000000C40000-0x0000000000C66000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3244	5d95c0868fefe2bf2ac14a5c09f455fb459d3b68da392f499ae60679c122bfcf.exe

C:\Users\Admin\AppData\Local\Temp\5d95c0868fefe2bf2ac14a5c09f455fb459d3b68da392f499ae60679c122bfcf.exe
"C:\Users\Admin\AppData\Local\Temp\5d95c0868fefe2bf2ac14a5c09f455fb459d3b68da392f499ae60679c122bfcf.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3244-0-0x0000000000C40000-0x0000000000C66000-memory.dmp

Filesize
152KB

Download
memory/3244-1-0x00007FFF98773000-0x00007FFF98775000-memory.dmp

Filesize
8KB

Download
memory/3244-2-0x00007FFF98770000-0x00007FFF99231000-memory.dmp

Filesize
10.8MB

Download
memory/3244-3-0x00007FFF98770000-0x00007FFF99231000-memory.dmp

Filesize
10.8MB

Download