Analysis
-
max time kernel
123s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
18-09-2024 03:10
General
-
Target
fcadb0f8b3f4d2f62ee32686bc4c9d93493145ae9720a28d0b2afffdf253e66d.exe
-
Size
71KB
-
MD5
9175e0d4944a8add7461d6b0f312e321
-
SHA1
92f40d5e927a96eff9c6916a651bb7e17dd0b31a
-
SHA256
fcadb0f8b3f4d2f62ee32686bc4c9d93493145ae9720a28d0b2afffdf253e66d
-
SHA512
4f5716a1353289dc58f2256832cd360fc138f031e5b7d791b4317576108efdf4a7f331382951862505ce4731604a54a32488feef360090db0f7fcac2135a1eb5
-
SSDEEP
1536:6ZbC2aJTIHzeerbZurGcywF3OKSW0QW0Qe:6ZOTIFbZu6i3OW0QWk
Score
10/10
Malware Config
Extracted
Family
xworm
C2
147.185.221.16:40164
147.185.221.20:40164
Attributes
-
install_file
tmp.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fcadb0f8b3f4d2f62ee32686bc4c9d93493145ae9720a28d0b2afffdf253e66d.exe"C:\Users\Admin\AppData\Local\Temp\fcadb0f8b3f4d2f62ee32686bc4c9d93493145ae9720a28d0b2afffdf253e66d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
10.8MB
-
Filesize
10.8MB