Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02/03/2025, 22:22
General
-
Target
config.exe
-
Size
83KB
-
MD5
676d43ca821b871113829fe4f4aef2d3
-
SHA1
1a3f4fedd5a621707778be0a01eb6ceea1d353e4
-
SHA256
e2a6cfcbdf54e388e2e4cf7bb7819bd8cf9afcad0be756d3d9b51045b0912ddb
-
SHA512
ad6a914de317ff963aa6f731baceda573b1386c06f0d178f792263e28e71f8af51702dae9e28d0e7ef22d4e4e40a0d0bd52aef8d7a17f9d40ce03d96380f64bb
-
SSDEEP
1536:xzKkCZ8ryPVw52HDRFJzUQgNVWLbKpLlrwFGGA6l5hOPiVqNfkglUKdar:xzKk5IpPqQbKfPkhO8qNfkQUDr
Score
10/10
Malware Config
Extracted
Family
xworm
Attributes
-
Install_directory
%Temp%
-
install_file
safemode.exe
-
pastebin_url
https://pastebin.com/raw/HNgp7VTj
-
telegram
https://api.telegram.org/bot7566882471:AAEsmeKHRV49kbZ72snynbsQH5x-Bnw1zK4/sendMessage?chat_id=1850507924
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\config.exe"C:\Users\Admin\AppData\Local\Temp\config.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
112KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB