Analysis
-
max time kernel
118s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-11-2024 08:19
General
-
Target
chrome.exe
-
Size
147KB
-
MD5
8a0da8925b19d58db5a209deed075a5a
-
SHA1
4d9a2a9aaaad27beae22abe3c27cb2b22b682c90
-
SHA256
c1284569276eee7aaf4b03a01b709a9e403eb23edd13c3b3f567e507b0129d9e
-
SHA512
3af14fad4a8aa6583828afc3d24b5742bfe4f3ea3fe2d16e9cb1449bf29d32c21c074eefede1a2af1dd71cb3c77af13de6844730ea244d98e648af6e0a94734e
-
SSDEEP
3072:7OFE9eVOjX4NpVq8BxFRzaqF+o2GQJ7/JzqVfGvp:8E9TgVqwlL
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
158.247.200.45:7033
Mutex
eZi6vzo05UjRpELo
Attributes
-
Install_directory
%AppData%
-
install_file
svchost.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\chrome.exe"C:\Users\Admin\AppData\Local\Temp\chrome.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
168KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
56KB