Analysis
-
max time kernel
112s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
06-11-2024 23:39
General
-
Target
9a63a14144f2bbaf883b43c46901542175d8dd2307b73f5ebb093862956ec623N.exe
-
Size
46KB
-
MD5
54fa6eae2fb6549957db7394336bca10
-
SHA1
7bbcbe664d21783ad0cd1b6122769a5f190e0dd9
-
SHA256
9a63a14144f2bbaf883b43c46901542175d8dd2307b73f5ebb093862956ec623
-
SHA512
67ee16402021257455a40024eded654e70a3e911c453333c9a8a2453a1d775542587c22e8f158656fac7cbd5f9c1dc37bcb3002849a9ff0f3c582c636b152627
-
SSDEEP
768:a0RbMun94y2fpX8BbmNm0Y/QL/r8bWgWzL4moXMnkbAj43/odKbD8O7h8SjvgC:3bMun94y2fSBbmYj/Q3aYr1kbAj43CKx
Score
10/10
Malware Config
Extracted
Family
xworm
C2
127.0.0.1:7777
leave-ages.gl.at.ply.gg:7777
Attributes
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a63a14144f2bbaf883b43c46901542175d8dd2307b73f5ebb093862956ec623N.exe"C:\Users\Admin\AppData\Local\Temp\9a63a14144f2bbaf883b43c46901542175d8dd2307b73f5ebb093862956ec623N.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB