Analysis
-
max time kernel
27s -
max time network
17s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
02/08/2024, 22:11
General
-
Target
XClient.exe
-
Size
33KB
-
MD5
48b9cdcb33c1a29398056d35bfa0645a
-
SHA1
d5bc1feec8b196005e733be26891ad7468f3aaf7
-
SHA256
3fa216500c3adc0968a049701032789556cd2abaabfdfcc8eb2ac8e05a01cf43
-
SHA512
42f2334faba03cef90242d5ff24fdbc8870c7f187388adf08836885d724cdb5a236285453d56a0a53dd5222de546e7e59279face8980c97c8099cda3ddb69dcb
-
SSDEEP
384:/E8PQ9Ba+vNuntf98d6ILj7CM42pfL3iB7OxVqWYRApkFXBLTsOZwpGN2v99Ikui:PUa+vNohsXn42JiB706VF49jHOjhkbz
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
127.0.0.1:8888
Mutex
9uBvYg0Ptt9Hc8LV
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB