Analysis
-
max time kernel
1791s -
max time network
1148s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
11-11-2024 20:24
General
-
Target
XClient.exe
-
Size
45KB
-
MD5
98513cddff4faad5bf3898ae44aaa4b6
-
SHA1
de5c611ffabeab8fc5d41c719b3e202bbdfcc449
-
SHA256
80b8d298052d28c5a7eafbbe5dfd3593c0c840f6a984b46899fd879234207406
-
SHA512
816e358f8aa295c357991ac1859bb1ecea38d030f75eaeb92fc443ca89cff0dca5bc860a46f3a50e23a14ac3fe4d53a79e3b25ebe5761c3924e322d0eb7b737f
-
SSDEEP
768:fRfGu0SC4MpQbwbHrveYk3j5RgO8gkb2WKu+9iw6PONhX/NMFtr:f9pMFIwbHSZHNkb2WvDPON/Er
Malware Config
Extracted
xworm
127.0.0.1:9841
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Modifies registry class 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5785073822344ae3813284ebc92bb596a
SHA196e2a933b38352ed2c8e6e34e94756b70c143214
SHA25636ef4cbbc494deacf81f364b546281223a39bea01a32b0c4b0e2324f984d6817
SHA51228b21e17fdf026a025503a2ae1014ea4e8ce5385e42396007a7a23aba3aecb591d225e2a90d47f6f9e02d34792d74b89547715d66899265dbf8372258ccf4498
-
Filesize
10KB
MD5327975ba2c226434c0009085b3702a06
SHA1b7b8b25656b3caefad9c5a657f101f06e2024bbd
SHA2566fa9064f304b70d6dcebee643ca017c2417ff325106917058f6e11341678583c
SHA512150a57c143fc5ff2462f496f5a9451310b8d99e32c4d570641204c8062a78590f14bed438ac981e8b0609a0c87b859a1f8502a78687bc36c3a9529d633a58e51
-
Filesize
8KB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB