Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
10/11/2024, 11:58
General
-
Target
55d8bcb74ff258c77d60f290b91310c45b97cb80f1aededa35e2304044dc8b3bN.exe
-
Size
69KB
-
MD5
ced29a27e2a6684f9f554883a61bff00
-
SHA1
6346414d8221ab5d6589200294030f07ce96c6bd
-
SHA256
55d8bcb74ff258c77d60f290b91310c45b97cb80f1aededa35e2304044dc8b3b
-
SHA512
88358c946e83e84dd0edd0dc2643086b5e30d4bd61e21bb0d820e078c156eac6878e2584e641a98fb7b2e5b4b8ad4d2b8a8edf6792b72b6ed3c8b93ae6385be6
-
SSDEEP
1536:BxdXl5vlC1gZt/XrP81wtCg7bKg3shraj6kYOD9J//4:VXlVCatTP812hbK/6YOZp4
Score
10/10
Malware Config
Extracted
Family
xworm
C2
success-select.gl.at.ply.gg:58004
Attributes
-
Install_directory
%AppData%
-
install_file
NursultanCrack.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\55d8bcb74ff258c77d60f290b91310c45b97cb80f1aededa35e2304044dc8b3bN.exe"C:\Users\Admin\AppData\Local\Temp\55d8bcb74ff258c77d60f290b91310c45b97cb80f1aededa35e2304044dc8b3bN.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
96KB
-
Filesize
9.9MB
-
Filesize
9.9MB