Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02-11-2024 14:42
General
-
Target
nursultan.exe
-
Size
60KB
-
MD5
9105e972f4ac2ef89c376baf88f2f98d
-
SHA1
152ea2db5f0529c7bc6e373c5f0c3ca89b156220
-
SHA256
5f8c50226b34130021e07f8cdb201d3ed8302680e0edd2cd8829ff8eb3e39bbf
-
SHA512
2b2b56211cddc79a89014d96aa53b5cf2a61d60dc877a6890988f042be7c53356bee3cf1f6bd0ad11b64d53c95eb9c26dc6e4cf10dec025399e140b9e6535f0a
-
SSDEEP
1536:fXZ47qwknRI0grWhHQmFCbRFSPrqEU2g47b6u/IEO5dE:BokbycCbRF+g479nO5dE
Score
10/10
Malware Config
Extracted
Family
xworm
C2
23.ip.gl.ply.gg:40630
127.0.0.1:40630
Attributes
-
Install_directory
%AppData%
-
install_file
svchost.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\nursultan.exe"C:\Users\Admin\AppData\Local\Temp\nursultan.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
9.9MB
-
Filesize
9.9MB