Analysis
-
max time kernel
35s -
max time network
36s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-11-2024 10:18
General
-
Target
bootstrapper (1).exe
-
Size
44KB
-
MD5
5d1d89a2699ed3ca9fe0237dda33a6ac
-
SHA1
d63f61d642f784bc10a350f32a479182b03d682d
-
SHA256
30a13d7c83bcfd573dfb5b090dfc551533fadb656ce4cd6bb67198c972420d83
-
SHA512
7e8289b6fab17d53a0b8973382493c5508606881fe0531ff6f93ffb20885474354ed35e8e66e96c275487647449d18970f5eec56b3a8d1292e81f98fb6231537
-
SSDEEP
768:IrdHBnsgvQh/4uBjYCbILjnrRM9XrLF+y9O196BO+hTbVLlhI:Ir1Bsgc/LBjYwQRMlF99S96BO+dVI
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
march-draft.gl.at.ply.gg:54205
Mutex
zPoc34Z8bMdUxAvQ
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bootstrapper (1).exe"C:\Users\Admin\AppData\Local\Temp\bootstrapper (1).exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
10.8MB