Analysis
-
max time kernel
74s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
11-11-2024 13:40
General
-
Target
3708e11d66b51b2e3b8881e815ab53579ac1f864a158cea1011b1a943149de3eN.exe
-
Size
113KB
-
MD5
9fc18afd674b13a508e116ee863026a7
-
SHA1
3f8cdbc06ea27dd8f013c777c5e22d253f5b34f7
-
SHA256
79f916df735b40246ca882bd118759adb5352c40c8a2568dc8efe1690ba1762c
-
SHA512
c1f07b5f36894fddaed3640d6ffaf10d675e16738f4de22726be2928ded57bc3dff3e00e53147ff9bcb74d2ff5fd93d32fa3726137817df4f66c762681a56dae
-
SSDEEP
1536:GMlhc/2KCQ/KEoDOfigkZbt0wN6EO2Sdfdq51:PGHr/QOfirbthO2Ydq51
Score
10/10
Malware Config
Extracted
Family
xworm
C2
sell-oc.gl.at.ply.gg:48959
Attributes
-
Install_directory
%Userprofile%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3708e11d66b51b2e3b8881e815ab53579ac1f864a158cea1011b1a943149de3eN.exe"C:\Users\Admin\AppData\Local\Temp\3708e11d66b51b2e3b8881e815ab53579ac1f864a158cea1011b1a943149de3eN.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
136KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB