Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
20/06/2024, 17:50
General
- Target XWorm.exe
- Size 108KB
- Sample240620-weypbszdnf
- SHA256 aac41ab4f44400f9be9d38bea40f5ecc6dffe9b2a0ff77be9017cb0cac956c8f
Score
10/10
Malware Config
Extracted
Family
-
xworm
C2
-
meet-showtimes.gl.at.ply.gg:33561:33561
Mutex
-
ccxFAV0dZFOG0nh1
Attributes
-
install_file
USB.exe
aes.plain
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWorm.exe"C:\Users\Admin\AppData\Local\Temp\XWorm.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1688-0-0x00007FFEB8E33000-0x00007FFEB8E35000-memory.dmp
memory/1688-1-0x0000000000C00000-0x0000000000C20000-memory.dmp
memory/1688-2-0x00007FFEB8E30000-0x00007FFEB98F1000-memory.dmp
memory/1688-3-0x00007FFEB8E33000-0x00007FFEB8E35000-memory.dmp
memory/1688-4-0x00007FFEB8E30000-0x00007FFEB98F1000-memory.dmp