Analysis
-
max time kernel
1731s -
max time network
1793s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
11-11-2024 20:47
General
-
Target
XClient.exe
-
Size
55KB
-
MD5
19b5d87e76c248b9d288c71415bba462
-
SHA1
e0665f86a7b8db622a64d225c46ff0fe9954710d
-
SHA256
b69d2bae7a7d3fd39f65eb66ebab178e6013966c6747260e0bf25cdfca435542
-
SHA512
00250801cbf9b0bdd73031a9f1ad2bfb52fb8668ea1a9a451a869020f6ea59347ff40a5a4fed4f8fc493c3ae6fbd713b113bb576b0285856761f9073ccbc72bb
-
SSDEEP
768:PuuTBjI+opX7APWGVh+hapndS53xHogkb7Ak6MO+AEzONnkvh7OWh4x5xtc:mOWr+m8ndS53ZkbEk6GZzOi7OWuf7c
Score
10/10
Malware Config
Extracted
Family
xworm
C2
147.185.221.23:45767
Attributes
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
80KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB