Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
05-11-2024 04:23
General
-
Target
d8c874b2f3101b888c0307a3135326263d65665adf93e5cada122c765a054adc.exe
-
Size
158KB
-
MD5
f39aa63640544e201c35e4ecc70f5b6c
-
SHA1
6f7cbcf265f9a8160df7e9f5344a377e26da93c1
-
SHA256
d8c874b2f3101b888c0307a3135326263d65665adf93e5cada122c765a054adc
-
SHA512
2ea8ac295d56cb017719eeca9eabc34fd23f724749d83883584d3a639b50ae2245e3eb89467d1621716c3ed54afcd822311c892fa15278b125329d93612ab08a
-
SSDEEP
3072:VyQjswuedxx2GFQ5psohfNUshn76Wtve7gRPyXVxj+5OWO8GwmQqoyK+EtY:VyQYOdyIQ5pvhfDn7HvcHC9Gw/ixE
Malware Config
Extracted
xworm
xxxx.freedynamicdns.net:1997
-
Install_directory
%LocalAppData%
-
install_file
explorer.exe
-
telegram
https://api.telegram.org/bot7470132733:AAFv29agMHCbkbiHbNHt7LzTib-Els5808o/sendMessage?chat_id=761641337
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8c874b2f3101b888c0307a3135326263d65665adf93e5cada122c765a054adc.exe"C:\Users\Admin\AppData\Local\Temp\d8c874b2f3101b888c0307a3135326263d65665adf93e5cada122c765a054adc.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
184KB
-
Filesize
96KB
-
Filesize
104KB
-
Filesize
6.9MB
-
Filesize
6.9MB