Analysis
-
max time kernel
119s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11/11/2024, 12:30
General
-
Target
3708e11d66b51b2e3b8881e815ab53579ac1f864a158cea1011b1a943149de3eN.exe
-
Size
113KB
-
MD5
b645a9fd6e1d775085c66632c7550cf0
-
SHA1
0ff50b1f08985123888e205224ac7e4992e0ffdb
-
SHA256
3708e11d66b51b2e3b8881e815ab53579ac1f864a158cea1011b1a943149de3e
-
SHA512
daa3a72001a5d613cf646cfebd43faf8ca8c8e221ae1a3facb36b8eeada5da4024f8e2a24b471614b1cf5b6657aeb691851eb95f23f7a0f933ca6f9ceb65190d
-
SSDEEP
1536:GMlhc/2KCQ/KEoDOfigkZbt0wN6EO2Sdfdq5:PGHr/QOfirbthO2Ydq5
Score
10/10
Malware Config
Extracted
Family
xworm
C2
sell-oc.gl.at.ply.gg:48959
Attributes
-
Install_directory
%Userprofile%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3708e11d66b51b2e3b8881e815ab53579ac1f864a158cea1011b1a943149de3eN.exe"C:\Users\Admin\AppData\Local\Temp\3708e11d66b51b2e3b8881e815ab53579ac1f864a158cea1011b1a943149de3eN.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
136KB
-
Filesize
9.9MB
-
Filesize
9.9MB