Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-01-2025 00:44
General
-
Target
XClient.exe
-
Size
227KB
-
MD5
cc4eac5e61739e6c548e7ed4b2220cdd
-
SHA1
cff1b657ba40e769585b946deead90c71d0acdda
-
SHA256
0cd7bf7f240311bafa5bbfd203f3db7a55fc045d3c2446ff96154592eec4c2f1
-
SHA512
77ae416a498e099b8af465b013dd0cf476bbd7d1b6d6517a7f5850735d5f8192c3b5f157de32bb33be1239cb5ea60feb14967ab82890faf6e4e0d0b17354fbbc
-
SSDEEP
3072:vMSS0s++bxAph0NZwO0b48SKfbzxcwg7es6/Vsb8VKTu549oJMfF/H9N3Ky9NzLP:xhgbtNZrUhcX7elbKTua9bfF/H9d9n
Score
10/10
Malware Config
Extracted
Family
xworm
C2
127.0.0.1:1234
Attributes
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
248KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB