Analysis
-
max time kernel
13s -
max time network
21s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
-
submitted
12-11-2024 11:02
General
-
Target
NewerWin.exe
-
Size
85KB
-
MD5
5636cc262a1ea73f360534991aa1583d
-
SHA1
217f76c8ba5f9ed4e3ce437a7998c9892ec5740c
-
SHA256
011753470736e81b7f8d17e0a9739f61f2fabd3211ae36584d2d57bbb3ea596a
-
SHA512
6d0004c9706a92f7777034d4d108a2eba8d1864468f71b03da319842bba9d0611b9fad53502d03b3bddf6b8ebecee70912c954db94a1fe581d29c49069adfc35
-
SSDEEP
1536:1nP61US1NLpoocGqsd+eC/b4ukt6L4QbHCaE6VOfBOrvSxnb1M+dXS:NP1elOoch2+xbhkpQbHPOJO7ObmqS
Score
10/10
Malware Config
Extracted
Family
xworm
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
-
pastebin_url
https://pastebin.com/raw/Hzb9qrsF
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NewerWin.exe"C:\Users\Admin\AppData\Local\Temp\NewerWin.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
112KB
-
Filesize
10.8MB
-
Filesize
10.8MB