Analysis
- max time kernel
42s - max time network
50s - platform
windows11-21h2_x64 - resource
win11-20240729-en - resource tags
- submitted
29/07/2024, 18:48
General
- Target XWorm V5.2.exe
- Size 12.2MB
- Sample240729-xfz48athpr
- SHA256 7fc9c7002b65bc1b33f72e019ed1e82008cc7b8e5b8eaf73fc41a3e6a246980e
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
TMzpx.dll
memory/3564-0-0x00007FFB21713000-0x00007FFB21715000-memory.dmp
memory/3564-1-0x000001BE8B230000-0x000001BE8BE68000-memory.dmp
memory/3564-8-0x00007FFB21710000-0x00007FFB221D2000-memory.dmp
memory/3564-9-0x000001BEA6B70000-0x000001BEA775C000-memory.dmp
memory/3564-10-0x00007FFB21710000-0x00007FFB221D2000-memory.dmp