Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07-11-2024 03:36
General
-
Target
f99ae2843d9c3ffa02e211777e7cfa2a9c759139ec922d062c5883679e8b3823.exe
-
Size
40KB
-
MD5
615786070805c9eb0ca58cf09682e9b0
-
SHA1
319b760d1015ee62f8dda6c673f7deed18c9f414
-
SHA256
f99ae2843d9c3ffa02e211777e7cfa2a9c759139ec922d062c5883679e8b3823
-
SHA512
bdda9588b7c759ccd197728061e48e2a91b30ffee11309d3acdcfb931f73fef5a4652625570158dde5134fae420cdb84d174d0cfe8b4f366eb7e91075a5ddf11
-
SSDEEP
384:nFLDb8mACT+aFifsEmn4w1+Qk7zuPgg8Kx493yBtrLaWGPjxLCPOnsSZwHV6cWRn:ZDb0I+a4DL7zg2Kd3yG92RlF
Score
10/10
Malware Config
Extracted
Family
xworm
C2
xworm1120.duckdns.org:1120
Mutex
D0iCsL6PUuq7iVxc
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
Processes
-
C:\Users\Admin\AppData\Local\Temp\f99ae2843d9c3ffa02e211777e7cfa2a9c759139ec922d062c5883679e8b3823.exe"C:\Users\Admin\AppData\Local\Temp\f99ae2843d9c3ffa02e211777e7cfa2a9c759139ec922d062c5883679e8b3823.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB