Analysis
-
max time kernel
147s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-11-2024 01:38
General
-
Target
Bloxstrap-v2.8.1.exe
-
Size
90KB
-
MD5
14d4016a97613c132cd0f5ef44bb89e5
-
SHA1
6bf013a301f5f18f4948806392f06552295cc71e
-
SHA256
05e8795cc1a3970c8f1175f05f013caffca9feecb7e53bff65c478b94c4fc722
-
SHA512
c0279b287cadc4cf97a454632a9161fd2ca24884e6e9ad8997b92f1781d5a17d137001828c924bc685d1f0ae997a0797189d818ead6d45ea13b20ce58b7329d4
-
SSDEEP
1536:0svC6eOgCMFU9YAOMH+HVFHwMuz8bkX0L9qrtOg3tzQUB/dP3/PKx5eClbm:00reOgJFU9YAOMenHwKkX0BsQEzQsPKG
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
127.0.0.1:7000
Mutex
VbFWnnjtfbUcjrCO
Attributes
-
Install_directory
%LocalAppData%
-
install_file
FileExplorer.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Drops startup file 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.8.1.exe"C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.8.1.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
112KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB