Analysis
-
max time kernel
165s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
08/10/2024, 20:27
General
-
Target
setup.exe
-
Size
41KB
-
MD5
8eab945fee9e24992a9f4175990b1f19
-
SHA1
b41956b072c8bf20fd71fab69b9fd3460da13306
-
SHA256
484a30b81cf3769281feb290886357834d18c2022a00394a5c591417fe0c5603
-
SHA512
52b4063529342d62de72f75ffafbf9f4fe47993f5facb012fd3990662d2c08d5fc426183321ff6869cbdd2d30aec77eabc75cc5bc8680fd723b60afc0b48cd29
-
SSDEEP
768:psydlfynBbCJvx5Ri0NTxtYJF5PJ9OACd68OMhd3E1V:psyfqnBbCTri0xfkFz9hE68OML0
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
members-korea.gl.at.ply.gg:11075
Mutex
9HyyMtIn425lv2KS
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\SyncWait.asx"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208KB
-
Filesize
992KB
-
Filesize
2.7MB
-
Filesize
16.7MB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB