Analysis
-
max time kernel
32s -
max time network
37s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
-
submitted
11-11-2024 00:16
General
-
Target
Bootstraper.exe
-
Size
67KB
-
MD5
ddcb1be57bce9e10c32d455940aecdc6
-
SHA1
93be8f161f53352785f8e4ce08712797d46900ea
-
SHA256
0c6332790046892160b1dbbd97a4bda82a4235ad5a86488e4f6191d468e5eac4
-
SHA512
0c3d6e8424f6882213600828cf7968ac57396ada85afae41294ff8420b9a15acbd4fd9a0046df49f246a7aaf841abc6b205a74e82868946096e26f34a1f693aa
-
SSDEEP
1536:21UUUYfqI6vINYoCJn8YsHZb148U7zE/66GIO+JOosBH:21RpQfoCu/HZb1nUUFOSOdBH
Score
10/10
Malware Config
Extracted
Family
xworm
C2
127.0.0.1:50460
oh-modifications.gl.at.ply.gg:50460
Attributes
-
Install_directory
%AppData%
-
install_file
Bootstraper.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bootstraper.exe"C:\Users\Admin\AppData\Local\Temp\Bootstraper.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
-
Filesize
96KB
-
Filesize
3.0MB
-
Filesize
3.0MB