Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20250211-en -
resource tags
-
submitted
11-02-2025 18:19
General
-
Target
Xeno-v1.1.3-x64/XenoUI.exe
-
Size
95KB
-
MD5
0c693fdf5031de28e139121866d4e71f
-
SHA1
d4e3f81ce0ac00efbc537b6aa4ebc07f039aaf9a
-
SHA256
3788b42e87c69c077868856b07c03e8606e0f49389c947231701100d99337e1c
-
SHA512
4298a579eea032e794ac4aaa2e18c793fbe0d3f33a2f8e948fde510427e604f06072b71703183c9ca88c73a805627187241f47845a9f16822243388ae5cb42af
-
SSDEEP
1536:gOTgjZ0JbSfMuafhOWR42zxMVY6dTPr/Wa5iiphLuM/APHV5y6SlSW8zXR:bT+WytdTPr/WAbK7Pby6S+zXR
Score
10/10
Malware Config
Extracted
Family
xworm
C2
127.0.0.1:5552
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.1.3-x64\XenoUI.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.1.3-x64\XenoUI.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
104KB
-
Filesize
10.8MB
-
Filesize
10.8MB