Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02-11-2024 12:30
General
-
Target
conhost.exe
-
Size
71KB
-
MD5
7fd47d1198c863ec2190ef7e39d53555
-
SHA1
b96a4dfab86e26d70af5f8618ac646b272385e74
-
SHA256
0052f49f6088308302f0a099ac7f89a512011136232bbda7cbd15721c2a48b1d
-
SHA512
ca569e2a161c492d3f2831bf2e163fd9fa363f481f64af8b233cfdc324e39dbf61925e18d67743d916517d182c4b16351ae5c9f36bc7ed1f7a073a7b11384b45
-
SSDEEP
1536:eXC7z+yH7qVMYl/Ce2WsW2Zdb5opKyIAaOQoDxqS:emP+Bybb5Ry8OQon
Score
10/10
Malware Config
Extracted
Family
xworm
C2
127.0.0.1:7000
185.84.160.54:7000
Attributes
-
Install_directory
%ProgramData%
-
install_file
conhost.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\conhost.exe"C:\Users\Admin\AppData\Local\Temp\conhost.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
96KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB