Analysis
-
max time kernel
91s -
max time network
148s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
-
submitted
20/07/2024, 09:16
General
-
Target
XClient.exe
-
Size
30KB
-
MD5
4e572953f62f40e06c703bfa467a7f30
-
SHA1
a314c5a414fe1bae2a3d361919687c8ded84dc81
-
SHA256
73ae033b73b065dc0b21899834ae6245aa720c51238b71c3b2ce2e204cce66f2
-
SHA512
fe30123767c28d4843c1d5cfa47243dd464bba850f359659a06f36b86e75b550c2cb2ed60a45502d24426625bf60db7a826a6cde3c5c3ed6de37580f732fb294
-
SSDEEP
384:+7wTA+5OfPgEBQqWvfcQLZe3s80hYACSqReAw2uRugtFuBLTIOZw/WVnvn9IkVuP:grgECfLH8MYAoReJ2uBFE9RjOqh0bT
Score
10/10
Malware Config
Extracted
Family
xworm
Version
3.1
C2
le-pencil.gl.at.ply.gg:6703
Mutex
qy78GsHGIzhmPXzQ
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB