Analysis
-
max time kernel
134s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02-11-2024 21:26
General
-
Target
bkcracker-privateV1.2.exe
-
Size
79KB
-
MD5
47abba11eb5de0176dc2620268f973b9
-
SHA1
88c65fd19f6f158164e7052285cb08a3bc3b1577
-
SHA256
e9757cf90a5b034412b7f5cdd7211b3274d22f981fa0cace2a4a67e0e9ad0be8
-
SHA512
cd9772dfa31d7b4fa81bc32d6c18db84f50bad47a80b0ba1f9d328ee532e0a3b72a4fbbd1d3739e469d4566bcf32fe5188a1f7969076b883b46f74416a7869e7
-
SSDEEP
1536:uq9exgGaR2sY5RYM/+YfYFb9qosm3zqjL/Rcop8OczVrl6n2L9v0gjRh:uqnfvEGmUFb9guoiOexl3MMh
Score
10/10
Malware Config
Extracted
Family
xworm
C2
10.0.0.97:7000
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bkcracker-privateV1.2.exe"C:\Users\Admin\AppData\Local\Temp\bkcracker-privateV1.2.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
104KB
-
Filesize
10.8MB
-
Filesize
10.8MB