xworm | ef9d2831cf11c271df7db118c74a9322c6f0d362eab3d57749906654c7858be3

Analysis

max time kernel
145s
max time network
152s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
14-11-2024 19:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef9d2831cf11c271df7db118c74a9322c6f0d362eab3d57749906654c7858be3.exe
Size

33KB
MD5

f1be2ff81227658111d7bb0900d87d82
SHA1

8416a9811e0a83343c13387a55b2d72fc666a994
SHA256

ef9d2831cf11c271df7db118c74a9322c6f0d362eab3d57749906654c7858be3
SHA512

622f30331713d3c4fa4fcc9963c1b52ff0f263802c936e3c669b1b4650c6b9134207df6c97d7dc5940257565acf3d8dabf0d040c16ee9c4b205f6e74d275ed52
SSDEEP

384:sEP7LGQ6ZXd0UmrpLSmPM42pfL3iB7OxVqWGRApkFXBLTsOZwpGN2v99Ikuisz86:pXGQ+OVXU42JiB70cVF49jA8dOjhIb4

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

research-was.gl.at.ply.gg:58470:3582

research-was.gl.at.ply.gg:3582

Mutex

oP3gVU2CgTGfE7IK

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1640-1-0x0000000000970000-0x000000000097E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1640	ef9d2831cf11c271df7db118c74a9322c6f0d362eab3d57749906654c7858be3.exe

C:\Users\Admin\AppData\Local\Temp\ef9d2831cf11c271df7db118c74a9322c6f0d362eab3d57749906654c7858be3.exe
"C:\Users\Admin\AppData\Local\Temp\ef9d2831cf11c271df7db118c74a9322c6f0d362eab3d57749906654c7858be3.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1640-0-0x000007FEF5D23000-0x000007FEF5D24000-memory.dmp

Filesize
4KB

Download
memory/1640-1-0x0000000000970000-0x000000000097E000-memory.dmp

Filesize
56KB

Download
memory/1640-2-0x000007FEF5D20000-0x000007FEF670C000-memory.dmp

Filesize
9.9MB

Download
memory/1640-3-0x000007FEF5D20000-0x000007FEF670C000-memory.dmp

Filesize
9.9MB

Download