Analysis
-
max time kernel
98s -
max time network
141s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
-
submitted
03-11-2024 01:18
General
-
Target
Zxy helper.exe
-
Size
63KB
-
MD5
76f29801c7aa5ef0d3ef99f82f04c82c
-
SHA1
613a078cd094694bf2564085e55b9ff31bbc7f8c
-
SHA256
b296bb5a1a3259f2985ab130c8eeccfd1a0b816c75da5ca52762b583f0fc32de
-
SHA512
62008027a6aacfa7c95f35ff4a010a11e037dab2617fcbd3446b9b0f99041054fe364537aaeacd518a2814c025639c4e4a12754f6a72ac3802830058e808fb79
-
SSDEEP
1536:YSlt/icqQPW2zZv+bDeffo6rdprO7sYdOY:vacqnWv+bDeXldprO4XY
Score
10/10
Malware Config
Extracted
Family
xworm
C2
where-reverse.gl.at.ply.gg:18649
Attributes
-
Install_directory
%ProgramData%
-
install_file
Helper.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 33 IoCs
-
Suspicious use of SendNotifyMessage 33 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Zxy helper.exe"C:\Users\Admin\AppData\Local\Temp\Zxy helper.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
88KB
-
Filesize
10.8MB
-
Filesize
10.8MB