Analysis
-
max time kernel
136s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-11-2024 01:22
General
-
Target
Zxyhelper.exe
-
Size
63KB
-
MD5
76f29801c7aa5ef0d3ef99f82f04c82c
-
SHA1
613a078cd094694bf2564085e55b9ff31bbc7f8c
-
SHA256
b296bb5a1a3259f2985ab130c8eeccfd1a0b816c75da5ca52762b583f0fc32de
-
SHA512
62008027a6aacfa7c95f35ff4a010a11e037dab2617fcbd3446b9b0f99041054fe364537aaeacd518a2814c025639c4e4a12754f6a72ac3802830058e808fb79
-
SSDEEP
1536:YSlt/icqQPW2zZv+bDeffo6rdprO7sYdOY:vacqnWv+bDeXldprO4XY
Score
10/10
Malware Config
Extracted
Family
xworm
C2
where-reverse.gl.at.ply.gg:18649
Attributes
-
Install_directory
%ProgramData%
-
install_file
Helper.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Zxyhelper.exe"C:\Users\Admin\AppData\Local\Temp\Zxyhelper.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
88KB
-
Filesize
10.8MB
-
Filesize
10.8MB