Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07-11-2024 02:11
General
-
Target
20355236f71216ff0468146e40060d1ca6d9d468ecd7c33049e98efa0756a267.exe
-
Size
35KB
-
MD5
9e8c98f74babd7b8a9c2d84d07c5b140
-
SHA1
ee67b43ddd03000158045436cc9688a4e102b35f
-
SHA256
20355236f71216ff0468146e40060d1ca6d9d468ecd7c33049e98efa0756a267
-
SHA512
d5035dc484279df58b8dc3e525f2bafc67207ab713f38cb29b284c65a33601a1aa40d104427fbd3e6b957d6473b530a058ae7d805c9a2bc120f942a72bab843c
-
SSDEEP
384:ygg9j00WbqxAMTayV5N+5maFZZL3CQpJm3/KNm0ob0VgtFMAmNLToZw/RZCvK9Iz:kB4QBTOl3CF3CNCVFQ9ioeOMhUkl7
Score
10/10
Malware Config
Extracted
Family
xworm
Version
3.1
C2
jameshde18.duckdns.org:8895
Mutex
W2eicRNCy3K0SdYM
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Drops startup file 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\20355236f71216ff0468146e40060d1ca6d9d468ecd7c33049e98efa0756a267.exe"C:\Users\Admin\AppData\Local\Temp\20355236f71216ff0468146e40060d1ca6d9d468ecd7c33049e98efa0756a267.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB