Analysis
-
max time kernel
94s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09-11-2024 02:27
General
-
Target
3793ec0ce7377024a044bfb4db49b2ca9c89726e39c05dfcc7bd30dd05812646.exe
-
Size
47KB
-
MD5
a56eb91e02fa5d139def4bf6f952ca7c
-
SHA1
9232c055aba6eb4cae8d85e5eef78582857cb012
-
SHA256
3793ec0ce7377024a044bfb4db49b2ca9c89726e39c05dfcc7bd30dd05812646
-
SHA512
3ef2f95369a52208ca6690fab9966d41165189f401ef57118f9cf661a530126a76d4cf1e5773528204d2979e44a94f6f8bdb137ba0157648da2f243d3ef7e8bc
-
SSDEEP
768:VO9OA32gn5HkqwEAvDdndbTnJXHRrC6Lx9QTsiPmhLO91wXe:gOi2S1iEARdf1Px9Qy1OEXe
Score
10/10
Malware Config
Extracted
Family
xworm
C2
found-fda.gl.at.ply.gg:49099
Mutex
vjoiUHY4pRhcpnSN
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3793ec0ce7377024a044bfb4db49b2ca9c89726e39c05dfcc7bd30dd05812646.exe"C:\Users\Admin\AppData\Local\Temp\3793ec0ce7377024a044bfb4db49b2ca9c89726e39c05dfcc7bd30dd05812646.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
1.0MB
-
Filesize
10.8MB