Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
24-01-2025 06:51
General
-
Target
1737701404fa7085385bfb79cbd0d6f35547f75f57270f2f6ee97e206b79cdebcd0ddf2d49957.dat-decoded.exe
-
Size
36KB
-
MD5
70eaf49a98e12f4d4de3c019c0baad11
-
SHA1
b48fa964e0c99e49ff2e9d4d74e2ead1457d9dcf
-
SHA256
38b88caf1dd809c6d77d8addce355a3e35dccab52f15ed67491437a49bace226
-
SHA512
2bafea3ab77685af33ee7b24ad4b84e6dfec5ea454815b9ccee522246a964ddaec4538d58f1d17090b80daf4a14a7476b35d2215bdaca49ddf8cc873e6ce3377
-
SSDEEP
768:vL13A5Uno9RfHWa2B71eo8icHyEWbFb9YyOMhSQXv8M:jxA5Uno9JHWXZeNicHyESFb9YyOM468M
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
85.31.47.24:1888
Mutex
ElNqLr9sSzibVsM9
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1737701404fa7085385bfb79cbd0d6f35547f75f57270f2f6ee97e206b79cdebcd0ddf2d49957.dat-decoded.exe"C:\Users\Admin\AppData\Local\Temp\1737701404fa7085385bfb79cbd0d6f35547f75f57270f2f6ee97e206b79cdebcd0ddf2d49957.dat-decoded.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB