Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-11-2024 15:54
General
-
Target
20428817e336776e739fd2dafec5cd45e2b7c8ffabbbc840ac0fa2ce26b55019.exe
-
Size
53KB
-
MD5
bea6f99060a151da90864ae96d3d1a95
-
SHA1
745cc417a866b7328f4e397b5a1eb879c6a192e4
-
SHA256
20428817e336776e739fd2dafec5cd45e2b7c8ffabbbc840ac0fa2ce26b55019
-
SHA512
0ec8e220ff4eae964415c4eb3ec556825332c2b53dbf3fd8e9700ec32ee16436fdedb21d1d45dbe84bea1c884adc1329eada55c401ee280c3ba99c4137cf0652
-
SSDEEP
768:EDotFM9Bohu4E30IqCHCThyhnJNf+VkbrC3OQITiYUkegOOh9fttp:hNu45CHmyhbSkbG+BiuOORtp
Score
10/10
Malware Config
Extracted
Family
xworm
C2
127.0.0.1:52794
tcp://tannerdontplay-52794.portmap.host:52794:52794
Attributes
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\20428817e336776e739fd2dafec5cd45e2b7c8ffabbbc840ac0fa2ce26b55019.exe"C:\Users\Admin\AppData\Local\Temp\20428817e336776e739fd2dafec5cd45e2b7c8ffabbbc840ac0fa2ce26b55019.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
80KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB