Analysis
-
max time kernel
133s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
03/03/2025, 22:43
General
-
Target
49378429748923748924.exe
-
Size
182KB
-
MD5
5df6c8897163145e579f422f211d1e57
-
SHA1
ab687541253e0abb0364ec9832177a8d4705f303
-
SHA256
cc1c23bbc163b87122a20be13618b95df865829748016fa35bcfec2620ef804c
-
SHA512
a979e0d8ac924997bd912ec53dbc5c081d7852e8ae79e582fdd2de834866fb05203cd0b86b6a915170b05059bcc69e7a82749b1414c01389aee097f9e928a472
-
SSDEEP
3072:ZH0ZkqJPZHvrZbx3GOHTOgx3XBz65/M6If+3Js+3JFkKeTno:Z4jZbRGOLBXxBt25
Score
10/10
Malware Config
Extracted
Family
xworm
C2
45.88.91.55:8893
Attributes
-
Install_directory
%ProgramData%
-
install_file
sys-32.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\49378429748923748924.exe"C:\Users\Admin\AppData\Local\Temp\49378429748923748924.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
208KB
-
Filesize
10.8MB
-
Filesize
10.8MB