Analysis
-
max time kernel
146s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
02/03/2025, 16:45
General
-
Target
Project IDE fixed.exe
-
Size
32KB
-
MD5
e2b1c0f552961b5d8fb3a7124c58d3b8
-
SHA1
c96bf4e5d58cb2eccc3335e7bcb0754989cb02a4
-
SHA256
da144a919db4a02f3371110350f40e5b98eec778b257b95d862081864f301748
-
SHA512
3079fbd1747ded18ce5518a473b5aa54ae80f046698ed54f3677f1016bd5d4acf12adb5b9b2ca839414d27670f87c0fac5ec386185de5b3ffa0a562f070ea00d
-
SSDEEP
384:vEbmX5Qa+vN1h1+X3v6JFjL+gP3Tm2eaFOrpdRApkFTBLTsOZwpGd2v99Ikuist:8Va+vNtg+PBP3Tw42pdVFE9j4OjhsbW
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
127.0.0.1:7000
Mutex
RGMCdXJ9uBejLCdB
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Project IDE fixed.exe"C:\Users\Admin\AppData\Local\Temp\Project IDE fixed.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB