Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02/03/2025, 02:43
General
-
Target
quietcc.exe
-
Size
66KB
-
MD5
8cce9d9b2604324a3fd73f16c1e57946
-
SHA1
611063dc8e949921502e91df4345069c0eb423b1
-
SHA256
9367a5b73fe3638560cc35e6343fab1375547f608e55f02ad185c15f35421c73
-
SHA512
e82d7d6ebf983e904b2a6aebb04d5c8b7dd5fe4329166d2f10341791172f2c461d8fafeef05d754c305c7b25fae72de7d12cf139e0116ff0b692275bca4e8652
-
SSDEEP
1536:va9We/cGq+OEJXdKtfbo0Ac06wLYUfO+KHL9Gs:uOEqtfbohhO+KH5Gs
Score
10/10
Malware Config
Extracted
Family
xworm
C2
127.0.0.1:4010
countries-allowed.gl.at.ply.gg:4010
Attributes
-
Install_directory
%ProgramData%
-
install_file
RobloxPlayerBeta.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\quietcc.exe"C:\Users\Admin\AppData\Local\Temp\quietcc.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB