Analysis
-
max time kernel
137s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06-11-2024 08:07
General
-
Target
1730880366c949f41b4c54cbed7fce25b8de844efb0a6612e8e8891129b97fcd02d628c162662.dat-decoded.exe
-
Size
33KB
-
MD5
394720df88d390d4a063f25afac9a951
-
SHA1
66e406ca76432ce19f38e0c600aaf568795e3bb4
-
SHA256
c77b61a7cf2a51edcdba31fdb826171fb37b24ff34b77ca9d782cbd66b6c04e2
-
SHA512
1e230188f90a69d80eaa58801bc68dbe03623076cd6a5c6a89df49430408e2a861f5d9eb39d41f083e1f489442efe375d0d34886b0f68b8e1a57ac5e767db1df
-
SSDEEP
768:+4fK1pDGkptwyZScCBSUapNgqlGU/fZl+BcgxeAlTF59iKO9hmSURp:ODGkptwyZScCkU4rAUXZcB5xeQF59iKD
Score
10/10
Malware Config
Extracted
Family
xworm
Version
3.1
C2
momentmoney79.duckdns.org:8895
Mutex
TA5i5eNovARcDNUK
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1730880366c949f41b4c54cbed7fce25b8de844efb0a6612e8e8891129b97fcd02d628c162662.dat-decoded.exe"C:\Users\Admin\AppData\Local\Temp\1730880366c949f41b4c54cbed7fce25b8de844efb0a6612e8e8891129b97fcd02d628c162662.dat-decoded.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB