Analysis
-
max time kernel
93s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09/11/2024, 03:25
General
-
Target
c56bfa4afd61f5fc95cb0c3b2dce23bd2a2c2656ab2df09fc98e584ebbe6a00e.exe
-
Size
45KB
-
MD5
dc3ad389d4ba11ef04240077f239d4ce
-
SHA1
ca1c017c859423c849d15da10ba9491319706f83
-
SHA256
c56bfa4afd61f5fc95cb0c3b2dce23bd2a2c2656ab2df09fc98e584ebbe6a00e
-
SHA512
3ef092a17f0a11a56c3a959a3fb875ff37b7e266b09e6f2542d174204169ed0e3802b268a753dd2a11dee4d3331fe3e0ba38b9d343951591db167039d3e5e9b1
-
SSDEEP
768:IurlDweV3OOVbADM9W1v9NfgkBpuAuREcNcFhlVvD4xeVhKfk/LbFEPa9pvg6iO1:IADweQKADMkV9GkSAcRaPlZrOc/FJ9Nf
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
127.0.0.1:33779
23.ip.gl.ply.gg:33779
Mutex
QXJjAl0pyGprRcPi
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c56bfa4afd61f5fc95cb0c3b2dce23bd2a2c2656ab2df09fc98e584ebbe6a00e.exe"C:\Users\Admin\AppData\Local\Temp\c56bfa4afd61f5fc95cb0c3b2dce23bd2a2c2656ab2df09fc98e584ebbe6a00e.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
10.8MB