Analysis
-
max time kernel
141s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
03/07/2024, 10:13
General
-
Target
XClient.exe
-
Size
33KB
-
MD5
5c7f9d7e424e55486da45c0496766c0d
-
SHA1
94798eaa3b48bc221d633e9b14670f954dc9e6a1
-
SHA256
5c7f2a41c842baab25b83b20bbec00f3d4fcd7489c5a74c0e7cf866334711a54
-
SHA512
35aae931410c53e02dfcdb9919643487b0a4af219f23cd60b53e2ea1f806d98916cd1cb556401cc396ef142c1d4ce0e4c333203d05541b6e321cccfd5b0da491
-
SSDEEP
384:f+i/Uua+vNijn/xVnzc6nLj7x3ZFsLcvSAOo5DRApkFTBLTsOZwpGN2v99IkuisX:na+vNkDpXx3HJvl1DVF89jaOjhpby
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
109.125.129.2:7118
Mutex
c3X97UGU45i1bmvz
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB