Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
03-11-2024 01:22
Behavioral task
behavioral1
Sample
Zxyhelper.exe
Resource
win7-20241023-en
5 signatures
150 seconds
General
-
Target
Zxyhelper.exe
-
Size
63KB
-
MD5
76f29801c7aa5ef0d3ef99f82f04c82c
-
SHA1
613a078cd094694bf2564085e55b9ff31bbc7f8c
-
SHA256
b296bb5a1a3259f2985ab130c8eeccfd1a0b816c75da5ca52762b583f0fc32de
-
SHA512
62008027a6aacfa7c95f35ff4a010a11e037dab2617fcbd3446b9b0f99041054fe364537aaeacd518a2814c025639c4e4a12754f6a72ac3802830058e808fb79
-
SSDEEP
1536:YSlt/icqQPW2zZv+bDeffo6rdprO7sYdOY:vacqnWv+bDeXldprO4XY
Malware Config
Extracted
Family
xworm
C2
where-reverse.gl.at.ply.gg:18649
Attributes
-
Install_directory
%ProgramData%
-
install_file
Helper.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/2624-1-0x00000000008C0000-0x00000000008D6000-memory.dmp family_xworm -
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2624 Zxyhelper.exe