Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-01-2025 01:56
General
-
Target
absa.exe
-
Size
40KB
-
MD5
460e1f1c0c297bbc5c338c845cc6cab3
-
SHA1
4d878c9c30bffaad9294f1b64ebe4195a0aa539e
-
SHA256
8b430fe278d3c9171af077e49b811e0b3df67e34f5eb45dad3de66ed43b857be
-
SHA512
90884dcb3b5b40a137ee2e0b6061d988f920d6932b38617d2be168333ccbb1dab320c2ea08176bbc1bddeb221314cd112db771e0dd8e4cc839b18620e5d92860
-
SSDEEP
768:NF02rc6FGMWmMAOCpwtF5Pf95eOMhR3/p:NFM4G97AOCpIFB95eOMvR
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
127.0.0.1:1319
147.185.221.25:1319
Mutex
0TSKzYpDexjIVmkQ
Attributes
-
Install_directory
%AppData%
-
install_file
Update.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Drops startup file 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\absa.exe"C:\Users\Admin\AppData\Local\Temp\absa.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB