Analysis
-
max time kernel
146s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04-11-2024 12:20
General
-
Target
XClient.exe
-
Size
33KB
-
MD5
5a477b280123ed81ebe667306561e763
-
SHA1
25ec76452e98949fe31600dbee4a0dc18bc3a008
-
SHA256
78434954ee3dacda0027e69eca39732230cc8b771fc6b09332091a6b2bca72a6
-
SHA512
b70c5ef32d73c6956364c487ea8328d8edb68e350c0aa3c8cdf3daf5d7e3966a6614feed3ff4c16d30d671fc678a9c2d527a3e2148cd59be7cc24086aa0b3c25
-
SSDEEP
384:jE8PQ9Ba+vNuntf98d6ILj7CM42pfL3iB7OxVqWGRApkFXBLTsOZwpGN2v99Iku:zUa+vNohsXn42JiB70cVF49jkOjhuby
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
127.0.0.1:7000
Mutex
5Xx4zMdTsZwdb9my
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB