Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-01-2025 16:36
General
-
Target
XClient.exe
-
Size
30KB
-
MD5
4662ec44c2d58c3e5f1ed9084c48536b
-
SHA1
5bfd776442f075d9bf36eab5e9a687446cbb0ae5
-
SHA256
15a1e3ff21bfe98291ab12df7d3586f9de3463ef56a7a5265b63fb45275da450
-
SHA512
9c4906e5282a48216af6eac6683e4d2b0962b58320ede06a5e3bac07f375116459545d70e29ca0c6c3893ab4b088d93d8ba51999cd7f272496f661311933e6f7
-
SSDEEP
768:ZrgECfLH8MYAoR/iw2uBFE9RAKcOqhEbU:dgRUiw24FE9RAKcOqGI
Score
10/10
Malware Config
Extracted
Family
xworm
Version
3.1
C2
5.tcp.eu.ngrok.io:19645
Mutex
4Oje8OMYMsrnJABB
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB