Analysis
-
max time kernel
130s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
24-01-2025 06:51
General
-
Target
1737701404df2e7c825ea690fee7791c11c4d92b123d433c354b4b740f5cc170482f95f759630.dat-decoded.exe
-
Size
36KB
-
MD5
c68b61002017f7c4e1b631191bd8b73b
-
SHA1
e49b699e7bc47686123a2aab0447569c0934a8f4
-
SHA256
f29265a2b0ef4c66b0a5ae64621ba86f02f5ccdc52e48636925c1b1560aee7a4
-
SHA512
d195c39f1c69e2ef8c92af14791b16059776488abb00b96ff2051140620161114333529041ff4df65522dea2c0efe7ba2d21ee131b2fb72a63d32bc6189088c5
-
SSDEEP
768:zL13A5Uno9RfHWa2B71eo8icHyEWbFb9YDOMhmQXvs:nxA5Uno9JHWXZeNicHyESFb9YDOMs6s
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
85.31.47.24:1888
Mutex
3OrfQWNZWWIB9sG2
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1737701404df2e7c825ea690fee7791c11c4d92b123d433c354b4b740f5cc170482f95f759630.dat-decoded.exe"C:\Users\Admin\AppData\Local\Temp\1737701404df2e7c825ea690fee7791c11c4d92b123d433c354b4b740f5cc170482f95f759630.dat-decoded.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
9.9MB