Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
08-11-2024 18:14
General
-
Target
a62f56f40d5b44bcaf4ddf5a7f2ad2ce6906be710a298d7ef9ec421b08428a14.exe
-
Size
30KB
-
MD5
c3ec0ce8d5128e683c20faa92434e7cf
-
SHA1
79cc440faa18ac3a3f21bc36ac32937a4665647d
-
SHA256
a62f56f40d5b44bcaf4ddf5a7f2ad2ce6906be710a298d7ef9ec421b08428a14
-
SHA512
d91f451618876a1bd7cb531644e65d207aed91da66d70da0be1c48f77d06c3766df8c43f5804da43090f91b7057687774f63df47b430b6ddc51c0c86adc79528
-
SSDEEP
384:x7wTA+5OfhxeelKn4MPLZhspJuXlYECwaiUXAsbRugtFuBLTIOZw/WVwvn9IkVu/:RFx7s4EQM1YETDUwsbBFR9RgOqhBbB
Score
10/10
Malware Config
Extracted
Family
xworm
Version
3.0
C2
deals-soccer.gl.at.ply.gg:51616
Mutex
34fdZJvEdwaDeqF7
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a62f56f40d5b44bcaf4ddf5a7f2ad2ce6906be710a298d7ef9ec421b08428a14.exe"C:\Users\Admin\AppData\Local\Temp\a62f56f40d5b44bcaf4ddf5a7f2ad2ce6906be710a298d7ef9ec421b08428a14.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB