Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
09-11-2024 09:57
General
-
Target
test.exe
-
Size
51KB
-
MD5
99f0724d278abad495410d5a482b438b
-
SHA1
fd00ce57a5d10d475343ce9a622f5f1299d414c8
-
SHA256
6bae80c68d9ed5c64d2f38e7fbfe83f78f7a94f8c3bfe87d5f77d0d8983641db
-
SHA512
2ffb3eec8f3be438a091f37cfd3c1e8e05dd5ac2cce49008e6f4949136d62b52787fad9c4fa4ddd14453f6392f69728f3fe50b4e1662a63b57ba93da15d7c292
-
SSDEEP
1536:PDs+2MePCXeJRtADzT7pyKPbj1QOnt/hCA:PDsSYt2n7py0bjyOn/5
Score
10/10
Malware Config
Extracted
Family
xworm
C2
0.tcp.ap.ngrok.io:12725
Attributes
-
Install_directory
%Public%
-
install_file
hh.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\test.exe"C:\Users\Admin\AppData\Local\Temp\test.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
80KB
-
Filesize
10.8MB
-
Filesize
10.8MB