Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
03-11-2024 18:20
General
-
Target
10f23d2bb9865c9a32b94dcd6057f8d866a60e5e39a3fb6fa77ede90005e87c4N.exe
-
Size
86KB
-
MD5
12095dbb7ef06f84fbb21054f0c33600
-
SHA1
6f54c3f2f38e5fb7252c2a9d641c40fc1300bc22
-
SHA256
10f23d2bb9865c9a32b94dcd6057f8d866a60e5e39a3fb6fa77ede90005e87c4
-
SHA512
3c30f99df8a5da7a9a1c8ec0197a9b5fcdff6417c009e4cabdab60c65c6c19ae0076c291271c58a66090037f0b7d99ab2eec9ea254140578b93186b1dcf2751a
-
SSDEEP
1536:1ubUIWL10oXnnnop+PBQwtGyybCnpeeL0t2Xz7M66T8NVO3755Ld3T:1u4vnopAAjbCpeeYtKfETmVOLZT
Score
10/10
Malware Config
Extracted
Family
xworm
C2
great-amanda.gl.at.ply.gg:43926
oil-graphics.gl.at.ply.gg:43926
23.ip.gl.ply.gg:43926
oevn.zapto.org:43926
96.230.131.253:43926
Attributes
-
Install_directory
%Userprofile%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\10f23d2bb9865c9a32b94dcd6057f8d866a60e5e39a3fb6fa77ede90005e87c4N.exe"C:\Users\Admin\AppData\Local\Temp\10f23d2bb9865c9a32b94dcd6057f8d866a60e5e39a3fb6fa77ede90005e87c4N.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
112KB
-
Filesize
9.9MB
-
Filesize
9.9MB