Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20250207-en -
resource tags
-
submitted
11-02-2025 18:19
General
-
Target
Xeno-v1.1.3-x64/XenoUI.exe
-
Size
82KB
-
MD5
cead4ff10b38e2da24c55582ce8602ea
-
SHA1
efbf5d6df5a8a928d8b2a00f14c94472d5708b32
-
SHA256
3da936a74e79a858404e820a7d0f9efd290d9299dd49a55305a865d07bd3d69a
-
SHA512
fc599e31caad9cec48143a8d1ad8536e6af980a5b98350c44d15ae81c9eb8e7141c1e0ca3a5896f45a0322dd97794c6cbb7c6dcbbed83f1f2f79ec59ac8b7140
-
SSDEEP
1536:IwIP5m99SZpD039LVdjMYWI7976Ob6G70ML476MrnEOstXl6daRG:IDo9wA9vjMSGOb6Gz4trEOsb6oG
Score
10/10
Malware Config
Extracted
Family
xworm
C2
127.0.0.1:5552
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.1.3-x64\XenoUI.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.1.3-x64\XenoUI.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
104KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB