Analysis
-
max time kernel
120s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-10-2024 01:54
General
-
Target
XClie423nt.exe
-
Size
79KB
-
MD5
9b1b6454633afe52cc8a6fda81fc8209
-
SHA1
be074db4129e77b42dcf88d0a3f3716034735fe3
-
SHA256
1f10f44f4dc64fc2c9cb4749e96451df7157aa1933f89e8bc72a07cb2b530c3e
-
SHA512
d3ac42e958e9b16375f32676673c7c2f350c87d77990e0d4d0d2350ca2730c87e4801829054fff079a30bf8e43975e60d985397a9ba70d278234e6abaff7f8ef
-
SSDEEP
1536:aC1VpVEDz6gXbzX0gkjXFCQbY5uO8Y6H/UOoNxoG:aYV6z6OSFHbYwO8F/UOoQG
Score
10/10
Malware Config
Extracted
Family
xworm
C2
turn-cement.gl.at.ply.gg:26362
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClie423nt.exe"C:\Users\Admin\AppData\Local\Temp\XClie423nt.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
104KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB