Analysis
-
max time kernel
132s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 16:12
General
-
Target
XClient.exe
-
Size
32KB
-
MD5
69fd4b2c424165a6335640a575e6b88b
-
SHA1
ffc801ec99ed46b72caea761fed13d0e85a9b5c2
-
SHA256
2003fb3946dac6fd33d26c68651ffbb7d6d0b79a84d678a03ea5fb0ed9cb89c7
-
SHA512
544857d2cdfe72e8b3d50675702878e990fa2148ae1e2d1dc7abc7b7aece8c59939fa85c48222b4ca68dc317327c4ca7e3aebd4260cf871ed9ed345517a6a744
-
SSDEEP
768:fVa+vNtg+PB93Tw4e1dVFE9jwBOjh0bNs1:XvNtgw93U4epFE9jwBOje61
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
10.0.0.136:80
Mutex
8a8z21q7nOh4kWyg
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB