Analysis
-
max time kernel
97s -
max time network
144s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
-
submitted
03-11-2024 05:47
General
-
Target
BootStrapper.exe
-
Size
63KB
-
MD5
c0fd9d3438390b8805ee4c259f2e4515
-
SHA1
d00f9e027be92d9df954818e69605a65c72d3e67
-
SHA256
5cc211a9596ae27be5cf99949a2dc7c1953140569c83848dd5628a1799479c2f
-
SHA512
1603fbf5409a0b5037573570f0ebeaa90be38953166535e3ab51d96760577011d64bd7aeb3798f805daca971cca67b141b00b215504589f5c8ddcf112fe7c38f
-
SSDEEP
1536:h5MY1tGpAzDlx/Ya5HbusBJu062uOCrMLdPm:XMYDrnbueurOCrQm
Score
10/10
Malware Config
Extracted
Family
xworm
C2
where-reverse.gl.at.ply.gg:18649
Attributes
-
Install_directory
%ProgramData%
-
install_file
Helper.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BootStrapper.exe"C:\Users\Admin\AppData\Local\Temp\BootStrapper.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
88KB
-
Filesize
10.8MB
-
Filesize
10.8MB