Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
-
submitted
02-10-2024 01:38
General
-
Target
d5f3ade8dcf776d15cb8c0fa90ae775c650f89617a586817e1656d15279f0d3b.exe
-
Size
84KB
-
MD5
7d367e5778501dd057e233dbbd917a48
-
SHA1
3fc55369d1f97ffe6ea236dd8878f923024a1dc0
-
SHA256
d5f3ade8dcf776d15cb8c0fa90ae775c650f89617a586817e1656d15279f0d3b
-
SHA512
c11e3a3bf96b43303cb4e2a8d5c91cb43c68f5a84d6ccc23bb2e5740bffde425ff73d747203d64f9aee66103fb9465e5284f64a57a7b9351080c8ed492b6e1be
-
SSDEEP
1536:rcM5lz+Dxn3KbGTkY/lRR6m+Mnkb5sMFj60/BOUqwYic93SznQygxx:J5lqeokY16mvkb5/JBO3iuSTk
Score
10/10
Malware Config
Extracted
Family
xworm
C2
45.156.30.9:1604
Attributes
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5f3ade8dcf776d15cb8c0fa90ae775c650f89617a586817e1656d15279f0d3b.exe"C:\Users\Admin\AppData\Local\Temp\d5f3ade8dcf776d15cb8c0fa90ae775c650f89617a586817e1656d15279f0d3b.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
104KB
-
Filesize
10.8MB
-
Filesize
10.8MB