Analysis
-
max time kernel
93s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-11-2024 04:13
Behavioral task
behavioral1
Sample
MsMpEng.exe
Resource
win7-20241010-en
windows7-x64
5 signatures
150 seconds
General
-
Target
MsMpEng.exe
-
Size
73KB
-
MD5
c10ed05ad6b6da082082307b9aee334b
-
SHA1
321a8c4ba3edb1b7c652aeadb96c05485e8e5ffc
-
SHA256
665a18b6ceed86e5bbeef6fcea46f9e047e26a14493d953b251a6bbdbb429539
-
SHA512
0592bcef39abe7abda1338430ae0c157e5637b4d093c2db210a967d84e168d4c8cbe9872c803dcaa3aa626c068bbb3ed0b10a25e502e9b509444392a143a32f3
-
SSDEEP
1536:knfTJbxJ5HP2Kd61ki95dbcftmf80bwXA6cAk53OswetbT:q/HPWNHdbcftmjcXHk53ODeJT
Malware Config
Extracted
Family
xworm
C2
45.141.26.214:7000
Attributes
-
Install_directory
%ProgramData%
-
install_file
MsMpEng.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral2/memory/536-1-0x0000000000600000-0x0000000000618000-memory.dmp family_xworm -
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 ip-api.com -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 536 MsMpEng.exe