Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02/03/2025, 16:18
General
-
Target
sexclient sieg heil.exe
-
Size
77KB
-
MD5
b183c4fdcf10f9eeeef779e3007d2e87
-
SHA1
6572478dc81eddb5b6e91a8bf80d0768fd71c778
-
SHA256
e87539a895bada2816d4b3dfa942fdf2ea94a762a9712dba43174ec280c9c3ec
-
SHA512
841b470cb8531b6e0915d9ecd3c28fcc4d49c0d7bed9d7dda7b7076cada3e13d6ce000ea1aa4de871cc00dc874559a2cfa7d577465c830025233128680c7283c
-
SSDEEP
1536:vvmG3l41yAhgJYrg/XdbGQ7apaiR4z6RhOjOE2aMZ0vLM6:vvm8nerUNbGraiRVYOE+Wo6
Score
10/10
Malware Config
Extracted
Family
xworm
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
-
pastebin_url
https://pastebin.com/raw/p1KPLDhy
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\sexclient sieg heil.exe"C:\Users\Admin\AppData\Local\Temp\sexclient sieg heil.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
104KB
-
Filesize
9.9MB
-
Filesize
9.9MB