Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
01/11/2024, 18:55
General
-
Target
2a3514578e78c6d33ec89ed24f693c84804f0f10545779cd11626eedb7bdfc14.exe
-
Size
64KB
-
MD5
713ca1f8ec4074b3ee385feded17e9cc
-
SHA1
bb3baa5440fbf87d097b27c60c7a95d53c85af02
-
SHA256
2a3514578e78c6d33ec89ed24f693c84804f0f10545779cd11626eedb7bdfc14
-
SHA512
8d16ade6aca158fad703bc9b1dd16af201efe629e39b5f86bbfdd524854a4783f1333c7e1820750d71ef299aef067ea01af4f0e0dbbadb15f657504845154557
-
SSDEEP
1536:I15a4wuu2+b19H0Hcg+ub2TdRZQvO64wROdYHJ3:0Y46r19UHKub2Zzr2OdYp3
Score
10/10
Malware Config
Extracted
Family
xworm
C2
127.0.0.1:6000
103.211.201.109:6000
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
-
telegram
https://api.telegram.org/bot7929370892:AAGwrX5TeyxQidZdAEm_Z6-CDvPUOQzVY1M
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a3514578e78c6d33ec89ed24f693c84804f0f10545779cd11626eedb7bdfc14.exe"C:\Users\Admin\AppData\Local\Temp\2a3514578e78c6d33ec89ed24f693c84804f0f10545779cd11626eedb7bdfc14.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
9.9MB
-
Filesize
9.9MB