Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01/11/2024, 19:12
General
-
Target
11ea34f77c834c824bfb59472c4c26a23918c13e701797a484a5e86544f18e7e.exe
-
Size
41KB
-
MD5
86fbf5b376b5daae4018e7a1652b298e
-
SHA1
c91283deb333efb4c0db91bac8839e084cc58e27
-
SHA256
11ea34f77c834c824bfb59472c4c26a23918c13e701797a484a5e86544f18e7e
-
SHA512
801b2a8ec2f2d195e62fe994eaec43f1af2883559df7d03320b801b164e7a8ef8a13e332eb06e2fc6d071e4bb81d09cad2da817e5e17fb84e8a962dd6617217c
-
SSDEEP
768:+7yYO3CpRkfGG3XvgggPLJF5PG9pmajs6vOwhu3EuzE:yT6CpRvgXvvgtFI9Aajs6vOwkNQ
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
0.tcp.eu.ngrok.io:10358
6.tcp.eu.ngrok.io:10358
4.tcp.eu.ngrok.io:10358
Mutex
QvDYkhYsc5WBgCcl
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\11ea34f77c834c824bfb59472c4c26a23918c13e701797a484a5e86544f18e7e.exe"C:\Users\Admin\AppData\Local\Temp\11ea34f77c834c824bfb59472c4c26a23918c13e701797a484a5e86544f18e7e.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB