Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02/12/2024, 18:04
General
-
Target
e28df9b4fe8cf6c4f407f1536ee07b6b641f7d4641723a0d7a05796c236babfe.exe
-
Size
64KB
-
MD5
1c60fa81854080166d34761610f776cc
-
SHA1
6ee883a9c2ad2c2da0521ace128e30d5134a5ccf
-
SHA256
e28df9b4fe8cf6c4f407f1536ee07b6b641f7d4641723a0d7a05796c236babfe
-
SHA512
e3cd8b5bb34dbba8995d39de34e2d541804c29ab930bfa365c803a00fa1e0f6738ba2afb42d740a180c7201f6599e1a26f82a38970247ac4c22728ace06d0040
-
SSDEEP
768:9GLtt3QI2/yQJVZsXeo8icHS1WbFb9YGQOMhwQnvO:9Ab3QI2/yQBKeNicHS1SFb9YGQOM6aO
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
dcxwq1.duckdns.org:7000
Mutex
KuxjcUwK7YR0UBzc
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e28df9b4fe8cf6c4f407f1536ee07b6b641f7d4641723a0d7a05796c236babfe.exe"C:\Users\Admin\AppData\Local\Temp\e28df9b4fe8cf6c4f407f1536ee07b6b641f7d4641723a0d7a05796c236babfe.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB