Analysis
-
max time kernel
599s -
max time network
600s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-01-2025 14:45
General
-
Target
WizClient.exe
-
Size
30KB
-
MD5
7ce2766cd0a7ff2d818b8fc5e24fec8f
-
SHA1
ed71e61ab4b135de19c5318b7fe0c447416ce28a
-
SHA256
c65ceb1d0d7df16616e1ff4a7176b28ae269f2cd2099077f80201f8c68e4ef7a
-
SHA512
5da8909faa15c5d27174c12c7f6cbec5d5e80ca8ce5873000a2665202b2e6f054c8ec8ea127d8efcfde5f1b4db5f930b2dcb2e5a2a5b6b597fb629d5c5602a96
-
SSDEEP
384:dfoCEwCPmtt37GRuSFWLLZk5ImYTEXXQmRuptFlBLTIOZw/W2Zvn9Ikn1ZGaNxOB:Cmtt3onGHm4QAm0FG9LrVrOqhibd
Score
10/10
Malware Config
Extracted
Family
xworm
C2
partners-mods.gl.at.ply.gg:5843
Mutex
dBP73MWk4nhnt7cz
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\WizClient.exe"C:\Users\Admin\AppData\Local\Temp\WizClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB