xworm | 04cfe85ad9f84a7bb65c39ed40e209fdd61f3a3cb52d0606a9fc41f780a2ba1f

Analysis

max time kernel
137s
max time network
153s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17/11/2024, 18:15 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04cfe85ad9f84a7bb65c39ed40e209fdd61f3a3cb52d0606a9fc41f780a2ba1f.exe
Size

33KB
MD5

f869f9d64a8a01aff088f8c830a477dc
SHA1

0e8af0081201e0d423abc29ae6f2cd948c12ba97
SHA256

04cfe85ad9f84a7bb65c39ed40e209fdd61f3a3cb52d0606a9fc41f780a2ba1f
SHA512

0da21ecb4896f716b1fb3b3e8813eb268aabd84f1e51f29c24fc6b8349ccfbd377d957828b437882d5ef65c654001f25a65259777ecd18980cdd0116afde876c
SSDEEP

384:Cl8UlK/V9FoBZ9aZV0NLx7o92lKZaJZvf/95ApkFy7BLT/OZwpGmTv99IkcisOHh:qO/VMOGxwgJZvn9dFyJ9FoOjh4Jy

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

sep-framing.gl.at.ply.gg:61526

Mutex

wCIHQbYCz8ryLWwh

Attributes

install_file
USB.exe

aes.plain

1
xatdIAfJqS4OmHLEPXnrfw==

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1620-1-0x00000000003A0000-0x00000000003AE000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1620	04cfe85ad9f84a7bb65c39ed40e209fdd61f3a3cb52d0606a9fc41f780a2ba1f.exe
Token: SeDebugPrivilege	1620	04cfe85ad9f84a7bb65c39ed40e209fdd61f3a3cb52d0606a9fc41f780a2ba1f.exe

C:\Users\Admin\AppData\Local\Temp\04cfe85ad9f84a7bb65c39ed40e209fdd61f3a3cb52d0606a9fc41f780a2ba1f.exe
"C:\Users\Admin\AppData\Local\Temp\04cfe85ad9f84a7bb65c39ed40e209fdd61f3a3cb52d0606a9fc41f780a2ba1f.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1620

Network

DNS

sep-framing.gl.at.ply.gg

04cfe85ad9f84a7bb65c39ed40e209fdd61f3a3cb52d0606a9fc41f780a2ba1f.exe

Remote address:

8.8.8.8:53

Request

sep-framing.gl.at.ply.gg

IN A

Response

sep-framing.gl.at.ply.gg

IN A

147.185.221.23

147.185.221.23:61526

sep-framing.gl.at.ply.gg

04cfe85ad9f84a7bb65c39ed40e209fdd61f3a3cb52d0606a9fc41f780a2ba1f.exe

152 B
3
147.185.221.23:61526

sep-framing.gl.at.ply.gg

04cfe85ad9f84a7bb65c39ed40e209fdd61f3a3cb52d0606a9fc41f780a2ba1f.exe

152 B
3
147.185.221.23:61526

sep-framing.gl.at.ply.gg

04cfe85ad9f84a7bb65c39ed40e209fdd61f3a3cb52d0606a9fc41f780a2ba1f.exe

152 B
3
147.185.221.23:61526

sep-framing.gl.at.ply.gg

04cfe85ad9f84a7bb65c39ed40e209fdd61f3a3cb52d0606a9fc41f780a2ba1f.exe

152 B
3
147.185.221.23:61526

sep-framing.gl.at.ply.gg

04cfe85ad9f84a7bb65c39ed40e209fdd61f3a3cb52d0606a9fc41f780a2ba1f.exe

152 B
3
147.185.221.23:61526

sep-framing.gl.at.ply.gg

04cfe85ad9f84a7bb65c39ed40e209fdd61f3a3cb52d0606a9fc41f780a2ba1f.exe

152 B
3

8.8.8.8:53

sep-framing.gl.at.ply.gg

dns

04cfe85ad9f84a7bb65c39ed40e209fdd61f3a3cb52d0606a9fc41f780a2ba1f.exe

70 B
86 B
1
1

DNS Request

sep-framing.gl.at.ply.gg

DNS Response

147.185.221.23

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1620-0-0x000007FEF5D13000-0x000007FEF5D14000-memory.dmp

Filesize
4KB

Download
memory/1620-1-0x00000000003A0000-0x00000000003AE000-memory.dmp

Filesize
56KB

Download
memory/1620-2-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmp

Filesize
9.9MB

Download
memory/1620-3-0x000007FEF5D13000-0x000007FEF5D14000-memory.dmp

Filesize
4KB

Download
memory/1620-4-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

DNS Request

DNS Response

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.