Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
01/11/2024, 19:56
General
-
Target
b8abd3a87339e1aea8fa843c4f9c2bfb55a870d28650222ca06b482795022357.exe
-
Size
325KB
-
MD5
d1552f8c6ea1a4e0f1c7d77190f70468
-
SHA1
b0e34de1d0fb1c1facdb84c528c72753efbade51
-
SHA256
b8abd3a87339e1aea8fa843c4f9c2bfb55a870d28650222ca06b482795022357
-
SHA512
ee3a3b13c95dfec14904aaabc8afa12aeccb3dd66e5d2726c36308c471f20f46aa96e88fe3a69099025d016347271a4b53ab6798701f40cc357e96862fd31474
-
SSDEEP
6144:DibyzpibBI+GIIIIIIIhIIIIIIIIIIIIIIIU:DibwS
Score
10/10
Malware Config
Extracted
Family
xworm
C2
157.66.26.208:8848
Attributes
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8abd3a87339e1aea8fa843c4f9c2bfb55a870d28650222ca06b482795022357.exe"C:\Users\Admin\AppData\Local\Temp\b8abd3a87339e1aea8fa843c4f9c2bfb55a870d28650222ca06b482795022357.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
352KB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
9.9MB