Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02-11-2024 16:14
General
-
Target
Fulloption_3.0.exe
-
Size
88KB
-
MD5
94be15b6d23986b1f085d036649dbdb1
-
SHA1
c871893da78093673b57d616044e61ade9209301
-
SHA256
c4cf13df8afc3f1f55f9fd30807958839110721316c19f1b0692bc99cb9921bf
-
SHA512
c62824c0e9f356e214f03577539380d2dac73f7da9768a8a6c7c63b59267c34ccd3c8211762de26b21c38162fd069714a4877594d3d9a2182ce0af5925104636
-
SSDEEP
1536:pvWgDObMMtlpgcHcR4FwdjGb1A4hJG6bPOhhWqAmoUxl:pvWH2wwYb1Ag7OipmD
Score
10/10
Malware Config
Extracted
Family
xworm
C2
127.0.0.1:7000
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fulloption_3.0.exe"C:\Users\Admin\AppData\Local\Temp\Fulloption_3.0.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
112KB
-
Filesize
9.9MB
-
Filesize
9.9MB