Analysis
-
max time kernel
141s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
20-11-2024 23:01
General
-
Target
561ab4f193269ea1ac346a8f89aad083cc7351d9d72a3e26fcf6ddd60578789a.exe
-
Size
54KB
-
MD5
6dc091991cdda9dec2cac93f0bd69aac
-
SHA1
c26c713661f115b0190ffa3ca90ba4fd35adfd10
-
SHA256
561ab4f193269ea1ac346a8f89aad083cc7351d9d72a3e26fcf6ddd60578789a
-
SHA512
d51c99ba5c3fcf83d8702ce535d9fb54f34d1244500b209e6e4397bb1bda912faf8824ab31b3d28afc0d474ed6bb193fbb93ca22075e804de21ebccd30c6ff0c
-
SSDEEP
768:QcduuGqruI0qzqLhOC08wb8hyhz/uJiJkbgrZSPExY8R5OOGmhDRtH:QcdB7SuAjJwb8MuykbgNjmOGmtbH
Score
10/10
Malware Config
Extracted
Family
xworm
C2
127.0.0.1:1604
Attributes
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\561ab4f193269ea1ac346a8f89aad083cc7351d9d72a3e26fcf6ddd60578789a.exe"C:\Users\Admin\AppData\Local\Temp\561ab4f193269ea1ac346a8f89aad083cc7351d9d72a3e26fcf6ddd60578789a.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
80KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB