Analysis
-
max time kernel
131s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04-11-2024 18:22
General
-
Target
nightware.exe
-
Size
33KB
-
MD5
bcad6018c1743a2a2822a8b8fd532f9f
-
SHA1
2cd27ff0be686a206a96c96d245d0bf5559b8996
-
SHA256
24078a0e79b673be45864b24a6cae1b13a856db53baf8279f616557bce9359d2
-
SHA512
dd0a2b259bfb5941ebfa7f8f3bb77cab5023f5b1cd4d6800252660177e34c0de4840aa83896713ebe1a144fd36fac2d8ab1816e51241b6c5eb204edb360131db
-
SSDEEP
384:9fP/SG1aTTcPTEUV75LC2NaM42pfL3iB7OxVqW1RApkFXBLTsOZwpGN2v99IkuiM:F11weF3Nf42JiB70LVF49j1n3Ojhfb5
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
127.0.0.1:48480
custom-monroe.gl.at.ply.gg:48480
Mutex
0wLt41S3luUixaA7
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\nightware.exe"C:\Users\Admin\AppData\Local\Temp\nightware.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB