Analysis
-
max time kernel
90s -
max time network
96s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
13-11-2024 13:11
General
-
Target
Expensiv load.exe
-
Size
76KB
-
MD5
5a6fdb879e69c3e019ef882c0b9484a0
-
SHA1
77bcd79d90ec9491e41b5607d4ecaea57e6b0666
-
SHA256
95d4c5ac094ce4fddd3ebbf20c0cda9f7dd2284d35a436115c510c5c8f427e63
-
SHA512
8d69b17f6cf60fab82fd51852f906d7443479604e8619aec96e4df8977ec6e98d10e442b39d0fd64c953597278d2ed9277edbb2cebbe57b27dedc03c66e65d05
-
SSDEEP
1536:04MlBSWcWFI2m5xbjplT6YyIoeOhSWRcika:z6FI7bjPXAeOh1Kika
Score
10/10
Malware Config
Extracted
Family
xworm
C2
every-plug.gl.at.ply.gg:54779
Attributes
-
Install_directory
%AppData%
-
install_file
svchost.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Expensiv load.exe"C:\Users\Admin\AppData\Local\Temp\Expensiv load.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
104KB
-
Filesize
10.8MB
-
Filesize
10.8MB