Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02-11-2024 17:04
General
-
Target
bSgJ.exe
-
Size
33KB
-
MD5
808e7cd14ef26b8060beb85b883e6426
-
SHA1
47f2bf06551cddf4734eead636327b8bef29b7b6
-
SHA256
83d944990a78952d5defbcc1ab47a9f9464a6e84890816a01310bc2d2f97b2c1
-
SHA512
861683f3b28c3e0fd8855def6560874aa2086576b15985c5279bb9a527361f2b13ca03e2dfc19c001ce4072c133268add109b3c94c4ce029aa45431c62be7909
-
SSDEEP
768:8o4fK1pDGkptwyZScCBSUapNgqVXU/kZl+Bcgo5tlTF592qO9hLdRP:9DGkptwyZScCkU4rRUsZcB5o5HF592q8
Score
10/10
Malware Config
Extracted
Family
xworm
Version
3.1
C2
tcxerr.duckdns.org:6677
Mutex
RSH70dBwgOkTVB0X
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bSgJ.exe"C:\Users\Admin\AppData\Local\Temp\bSgJ.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB