Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
21-01-2025 00:20
General
-
Target
ed75ef4bd376a3d6afe90487c3398b9b89bdc0d503a5906563f985af7862995d.exe
-
Size
32KB
-
MD5
5ebe16ac906d816b17510357377fbb01
-
SHA1
99cc1946ea1f5757a93bbfef16cd276b88713209
-
SHA256
ed75ef4bd376a3d6afe90487c3398b9b89bdc0d503a5906563f985af7862995d
-
SHA512
79593cc9c716d731c1e2eaf97f4a06217e6e5aae55145333d11c87264e66efd76ae90a84149a865eaf6a414885ab14149a01be8bba2170223123f7e5445dfb82
-
SSDEEP
384:bEbmX5Qa+vN1h1+X3v6JFjL+g93Tm2eaFO4FzRApkFTBLTsOZwpGd2v99Ikuisqd:oVa+vNtg+PB93Tw49FzVFE9jTOjhOb4+
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
127.0.0.1:7000
Mutex
i709h2VhFlRsldOu
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed75ef4bd376a3d6afe90487c3398b9b89bdc0d503a5906563f985af7862995d.exe"C:\Users\Admin\AppData\Local\Temp\ed75ef4bd376a3d6afe90487c3398b9b89bdc0d503a5906563f985af7862995d.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB