Analysis
-
max time kernel
27s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
26/07/2024, 17:02
General
-
Target
33a6f4dc80dc4e5905a75daf32eadda0N.exe
-
Size
40KB
-
MD5
33a6f4dc80dc4e5905a75daf32eadda0
-
SHA1
fb1c74e9a03e733f9503fab13321019971d126a9
-
SHA256
880cd3e12a04e3f7f3c5f8f4590a173c7ac1c002fe51c8f5402242ae16678592
-
SHA512
46a2943dba5a9ae291c394420c408e595fe51d6a41b0be78615962e46d974927bd14844b84cc260bf742b5e1e0015bd786aab328026d63a58fb3956f21a578b7
-
SSDEEP
768:OLgkC89svh2NF+FNF+qwSLI5FJ939O+hxFqW:Rkl9svk6vnKFJ939O+v4W
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
79.110.49.108:7000
Mutex
Gl8VlPz3QNlHoq2H
Attributes
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot7308985488:AAGrVsVwAJuqKL1W4h4nAKjoaz9IT_AjT9U/sendMessage?chat_id=7261388352
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\33a6f4dc80dc4e5905a75daf32eadda0N.exe"C:\Users\Admin\AppData\Local\Temp\33a6f4dc80dc4e5905a75daf32eadda0N.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB