Analysis
-
max time kernel
98s -
max time network
135s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
-
submitted
10/11/2024, 17:33
General
-
Target
XClient.exe
-
Size
33KB
-
MD5
47b197f16face93814adfec054a2a9bd
-
SHA1
a4f5a8c9333d038719372ffc375ef091ab834a8e
-
SHA256
1457255025579c965caeae70fb78e8b65fa1791cac8524c35dfec8124c3093f1
-
SHA512
34d143afb614a64d623b0a9a7f7d26f49b192c59e5b0ded379cb0f4d9a731cef3cc5cc2399d27d5118c2392ffab7b81fa420748005afdaf1c6b2a67721a322c8
-
SSDEEP
768:1AKdijXMwX1eJGl8y0UaKt4qNGU/fZl+BcgN7AlTF59i8O9hVS8Rt9:KjXMwX1eJGl8y0UbTIUXZcB5N7QF59ip
Score
10/10
Malware Config
Extracted
Family
xworm
Version
3.1
Mutex
avDNEinrJ0P6RQUY
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB