Analysis
-
max time kernel
93s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
04/10/2024, 16:47
General
-
Target
1728060366c73c2b51b3cccf4f90f5b82277982346f63fadf74c16a31e498f81a01832ef6b761.dat-decoded.exe
-
Size
32KB
-
MD5
8835790c46351f49444f7a5e73d4578e
-
SHA1
cde0ffd6c374b70373ea045b09d5d2db8af9a322
-
SHA256
b24e8948d314d492f4e1ae9fd78e8fcb41ee5c9adfd6e9ab7927fca7c333003c
-
SHA512
db0adeb1194209150b0bf295e6c1d0f588149865e8091ec7a272ed485face439e44257b23a2964497b032de51a2fc08aed490c8bc434ee9ec40654823bf200ca
-
SSDEEP
384:HEbmX5Qa+vN1h1+X3v6JFjL+g93Tm2eaFOzFzRApkFTBLTsOZwpGd2v99Ikuisgr:UVa+vNtg+PB93Tw4OFzVFE9jpOjhkbB
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
65.52.240.233:5555
Mutex
ufaRcrPtpogUcj6M
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1728060366c73c2b51b3cccf4f90f5b82277982346f63fadf74c16a31e498f81a01832ef6b761.dat-decoded.exe"C:\Users\Admin\AppData\Local\Temp\1728060366c73c2b51b3cccf4f90f5b82277982346f63fadf74c16a31e498f81a01832ef6b761.dat-decoded.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB