Analysis
-
max time kernel
34s -
max time network
34s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-11-2024 19:01
General
-
Target
8a3560cc3874da4b2706ec801addf92a5e425c03fa54d8d105d37b24c0185268.exe
-
Size
67KB
-
MD5
4779be9e708508f643b31d997d0c26ff
-
SHA1
8f590329114fdf67ee61686e85642bd4f3ff2a60
-
SHA256
8a3560cc3874da4b2706ec801addf92a5e425c03fa54d8d105d37b24c0185268
-
SHA512
f6e344e09b743a4e5cbd1d861e57bdf7928a6eb5ed0b580557b99130b5f1012e2f539ff1a4ad1f7fb8f5950dfe1ce53fe9347d02fe77e9ed35112e580724b9c0
-
SSDEEP
1536:JPamCStxokeVCh4bpBSQZn2Tm3g6ePOkESeADq:FBCwxH5h4bpB5SKYPOkESe8q
Score
10/10
Malware Config
Extracted
Family
xworm
C2
185.84.160.159:3306
Attributes
-
Install_directory
%AppData%
-
install_file
svchost.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a3560cc3874da4b2706ec801addf92a5e425c03fa54d8d105d37b24c0185268.exe"C:\Users\Admin\AppData\Local\Temp\8a3560cc3874da4b2706ec801addf92a5e425c03fa54d8d105d37b24c0185268.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
10.8MB
-
Filesize
10.8MB