Analysis Overview
SHA256
9d1dbb110b3f05793f358b06b04ee4d14d9a13c4198c7fdf3fd2e445ffae0bd3
Threat Level: Known bad
The file dude.exe was found to be: Known bad.
Malicious Activity Summary
Xworm
Detect Xworm Payload
Xworm family
Unsigned PE
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-06-20 18:16
Signatures
Detect Xworm Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Xworm family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-20 18:16
Reported
2024-06-20 18:19
Platform
win7-20240611-en
Max time kernel
143s
Max time network
118s
Command Line
Signatures
Detect Xworm Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Xworm
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\dude.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\dude.exe
"C:\Users\Admin\AppData\Local\Temp\dude.exe"
Network
Files
memory/2900-0-0x000007FEF5613000-0x000007FEF5614000-memory.dmp
memory/2900-1-0x0000000000B00000-0x0000000000B0E000-memory.dmp
memory/2900-2-0x000007FEF5610000-0x000007FEF5FFC000-memory.dmp
memory/2900-3-0x000007FEF5613000-0x000007FEF5614000-memory.dmp
memory/2900-4-0x000007FEF5610000-0x000007FEF5FFC000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-20 18:16
Reported
2024-06-20 18:19
Platform
win10v2004-20240508-en
Max time kernel
150s
Max time network
51s
Command Line
Signatures
Detect Xworm Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Xworm
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\dude.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\dude.exe
"C:\Users\Admin\AppData\Local\Temp\dude.exe"
Network
Files
memory/4280-0-0x00000000008C0000-0x00000000008CE000-memory.dmp
memory/4280-1-0x00007FF9D55F3000-0x00007FF9D55F5000-memory.dmp
memory/4280-2-0x00007FF9D55F0000-0x00007FF9D60B1000-memory.dmp
memory/4280-3-0x00007FF9D55F0000-0x00007FF9D60B1000-memory.dmp