Analysis
-
max time kernel
111s -
max time network
116s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
21-11-2024 00:25
General
-
Target
81f39d54f347a0e71bf1ece267aa679bc5912ecf591c5ed5b4ae0f8fdf7462fb.exe
-
Size
33KB
-
MD5
fb8d213a6c5bb486fd93b4bd1c538421
-
SHA1
e943a403f80018444eb0e5a3b46820c771e17615
-
SHA256
81f39d54f347a0e71bf1ece267aa679bc5912ecf591c5ed5b4ae0f8fdf7462fb
-
SHA512
8a59ea700bcb1174995d2cf86b0fbe2cd897f2870ab98b503301c3ba9e1750efbc5c1bf4acc9b288fc44e8c1addac847539f52c12a56c8e93a366777c8c03306
-
SSDEEP
768:eXGQHJVcAiwkFwYqimZoVFY9jaOjhSbpR:MGQH9kSqm0FY9jaOjgdR
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
yourself-member.gl.at.ply.gg:6852
yourself-member.gl.at.ply.gg:51770:6852
Mutex
WSylgOpSlNAMV60k
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\81f39d54f347a0e71bf1ece267aa679bc5912ecf591c5ed5b4ae0f8fdf7462fb.exe"C:\Users\Admin\AppData\Local\Temp\81f39d54f347a0e71bf1ece267aa679bc5912ecf591c5ed5b4ae0f8fdf7462fb.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB