Analysis
-
max time kernel
1790s -
max time network
1160s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
11-11-2024 20:26
General
-
Target
XClient.exe
-
Size
52KB
-
MD5
6cb398a9fb65fcd442a9e43e8f2a319e
-
SHA1
b61df8572cd4ffb4dfd1efc04986457befb09c2f
-
SHA256
4aa3f23ebca068c967a7ee104f6bee122ca4b14955bdc1f0e351c345646475d1
-
SHA512
7001a4540705d4551bf78310caa5efee1000bda4ba5d7571cf6f90b90f6cfea4f3e51ce39a779e787f3cf25419ea78db2073487c79ed2d7c7fb309bb77d1d75a
-
SSDEEP
1536:rdMuIkuPn2Qw7OckmXUkbpzAOr1sOQQRPf:rdpnEn2TJXUkbpzkOQU
Score
10/10
Malware Config
Extracted
Family
xworm
C2
127.0.0.1:16979
Attributes
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
80KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB