Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
09-11-2024 05:18
General
-
Target
TEST.exe
-
Size
33KB
-
MD5
c75f94c10d9775a849b2b020ffe70fe1
-
SHA1
53e7b1538417149e2d73b09de44303774ddb9b0d
-
SHA256
fa9bd921a6fc70e7b9f808131068ae12b8d6ede6542116707cbcc58c972fd52d
-
SHA512
a8f8ec4cf2ab6a3da4764000d28552d926c8836f708f66ed7af87789dd8281aa2adecbcbae4b74635ea99178fe400ad2cf40ed2584cda20208b1d65f5a2ad5b6
-
SSDEEP
384:Tl+PkjD9+E5MFs7iui8L7zjM42pfL3iB7OxVqWFiRApkFXBLTsOZwpGN2v99IkuD:J+CD93W03I42JiB70SVF49jQOjhzbw
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
longer-thy.gl.at.ply.gg:58559
Mutex
nprunfnny8f4USMz
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TEST.exe"C:\Users\Admin\AppData\Local\Temp\TEST.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB