Analysis
-
max time kernel
130s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01/11/2024, 17:50
General
-
Target
cf0793dd79285e039745f37cae227a8298191075cfb57672d7d36e0cdfef0d63.exe
-
Size
75KB
-
MD5
2c642c51cfc83fd4866a05d6a6b63be9
-
SHA1
0b174996038b8326d7878971f08efd5a4c31aa67
-
SHA256
cf0793dd79285e039745f37cae227a8298191075cfb57672d7d36e0cdfef0d63
-
SHA512
4ac8c5e3146b9ac27e65e73b2c62bda61336d2821997464363b53beb5287a8a590c4b0a545b5c5f165f36a57ed1d30345a3e49ce8d9c083c8bc7ebf118d5df6b
-
SSDEEP
1536:shfgMPrf/YopXX7TSeRuyhFq9HdBFbrDBYNiPR6KOijSe3gK:shfHP7PXrTSrWFq9HVbrqEPBOijS5K
Score
10/10
Malware Config
Extracted
Family
xworm
C2
127.0.0.1:1016
Attributes
-
Install_directory
%AppData%
-
install_file
svchost-service.exe
-
telegram
https://api.telegram.org/bot7299609726:AAF2JCjFJR7TmN4hpow1L_o0VYVcxdRdbkA
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf0793dd79285e039745f37cae227a8298191075cfb57672d7d36e0cdfef0d63.exe"C:\Users\Admin\AppData\Local\Temp\cf0793dd79285e039745f37cae227a8298191075cfb57672d7d36e0cdfef0d63.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
104KB
-
Filesize
10.8MB
-
Filesize
10.8MB