Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-01-2025 03:20
General
-
Target
ba2596817b32f9dfc9358119e4a294b5673cefe55b991ce49d94f36b79c7268a.exe
-
Size
36KB
-
MD5
648c182e090bbda47f228fb15eaa7daa
-
SHA1
5c6b5a0f89b91cee34112357979202633b787490
-
SHA256
ba2596817b32f9dfc9358119e4a294b5673cefe55b991ce49d94f36b79c7268a
-
SHA512
2dcd49dde2294b6b41c90befda6144bcbae610d660d51b009770fcc2edd923bbb078dde9b569d76ea4fd5ffa9c3072ff66dedae52fc7e1da27d13516890597f5
-
SSDEEP
768:zL13A5Uno9RfHWa2B71eo8icHyEWbFb9Y2OMhrQXvc:nxA5Uno9JHWXZeNicHyESFb9Y2OMd6c
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
85.31.47.24:1888
Mutex
KYDPmLKQ1YuSniXQ
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba2596817b32f9dfc9358119e4a294b5673cefe55b991ce49d94f36b79c7268a.exe"C:\Users\Admin\AppData\Local\Temp\ba2596817b32f9dfc9358119e4a294b5673cefe55b991ce49d94f36b79c7268a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB