Analysis
-
max time kernel
138s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
05-11-2024 04:46
General
-
Target
a75cfaa444c74cafb29c507b69974f06c7a886057fd31f42aaa9d213f5d9c719N.exe
-
Size
32KB
-
MD5
86696aa797949de1642e5a083ae691c0
-
SHA1
ad3bafcb574e3b349e539a4f4994f3924e8ee1f4
-
SHA256
a75cfaa444c74cafb29c507b69974f06c7a886057fd31f42aaa9d213f5d9c719
-
SHA512
be1a2568c44ffac512aac4457cd9a3b81598c457ac0bb71a3c8ce543c6a4ef9f693b01cb1aaad95b3f6f9b2a3fe8f6852fceab198dc431295bb782a14d8f240b
-
SSDEEP
768:VVa+vNtg+PB93Tw4hFzVFE9jwFOjh2bm:1vNtgw93U4hnFE9jwFOjkS
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
192.168.1.11:7000
Mutex
YnelI9iZlWlicpKJ
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a75cfaa444c74cafb29c507b69974f06c7a886057fd31f42aaa9d213f5d9c719N.exe"C:\Users\Admin\AppData\Local\Temp\a75cfaa444c74cafb29c507b69974f06c7a886057fd31f42aaa9d213f5d9c719N.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB