Analysis
-
max time kernel
146s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
17-11-2024 22:30
General
-
Target
MONEYX_V2.exe
-
Size
33KB
-
MD5
e2e09769c436bfba3a7682cb11b3fba4
-
SHA1
8d8404f1c1e16738783ab451938d867dca3ac2c8
-
SHA256
5846884597b07f14aae6b6b0f1e3b772a1fb793fd0bdf2279a9db80c351d5ef1
-
SHA512
fe64c16fc460a7b36e6bae294e25fd7ffbc18b230555cd8fbc9165cf12c9f62c3ba12dfac564d68fdde46c83d24541c0a7893eefb5980b50faac7d2b299935d7
-
SSDEEP
384:LE8PQ9Ba+vNuntf98d6ILj7gM42pfL3iB7OxVqWcRApkFXBLTsOZwpGN2v99IkuU:LUa+vNohsX942JiB702VF49jHOjhebv
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
127.0.0.1:8080
Mutex
ktKVqk3oYAJG8idg
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MONEYX_V2.exe"C:\Users\Admin\AppData\Local\Temp\MONEYX_V2.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB