xworm | 64348ec4267b52c1a7f639ccfaf9478b6d5159f796176076650901e5b7c0e1df | Triage

Analysis

max time kernel
0s
max time network
0s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 22:09

Sharing

Report Analysis Logs

General

Target

tumblr-main/svchost.exe
Size

54KB
MD5

161f7262ae9a6d95ce0f93e46cc5fcf9
SHA1

164551a9330c19a9ed62b6e7d54c6d247704b5e0
SHA256

73a74ebd5e95700aef901c8771fc4b64a677885f23e15bd67628b38e726f7408
SHA512

63bcc54b5846ec20e65c660054d5f6051f357bf803451bf740d7d27505dcc3497a122d62e62ed966329d5b713b8848300bb5ddd77025a3b53cd0d53a19a4c3ea
SSDEEP

1536:SgkETz/wBd3o3nnJWbdWDc06KVnO/jtg:SGnIcXJWbdWBnO/xg

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

C2

45.10.151.182:7000

Attributes

Install_directory
%AppData%
install_file
svchost.exe

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2280-1-0x00000000013E0000-0x00000000013F4000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description	pid	Process
Token: SeDebugPrivilege	2280	svchost.exe

C:\Users\Admin\AppData\Local\Temp\tumblr-main\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\tumblr-main\svchost.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2280-0-0x000007FEF5863000-0x000007FEF5864000-memory.dmp

Filesize
4KB

Download
memory/2280-1-0x00000000013E0000-0x00000000013F4000-memory.dmp

Filesize
80KB

Download