Analysis
-
max time kernel
78s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
03/03/2025, 19:06
General
-
Target
Realtek HD Audio Universal Service.exe
-
Size
53KB
-
MD5
ce3e5f8613ea049b651549eba3e3aa28
-
SHA1
1197375be314ae5a69f3b742f0f539b881aca09a
-
SHA256
9385116a4a3874548ffa027f4cd448d860ef8dc13fc687ce87790a01ede8e73a
-
SHA512
ab1428177b5ec71447003ac01f5f99d9c7f2af634f17ef53d6f6be196714faac856b0bc3f62b6fad9975dad970ec247d35f56615c62b9ad483426f4ecaae71c2
-
SSDEEP
768:/63AQe9cfNbv5s7Xol68y+JN/Db3dLPowu7aR6vaTOouhIZqklm:/WAQbdvoolZJ9b3dLPoCR68OnkZ8
Score
10/10
Malware Config
Extracted
Family
xworm
C2
147.185.221.23:58112
Attributes
-
Install_directory
%AppData%
-
install_file
Realtek HD Audio Universal Service.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
80KB
-
Filesize
10.8MB
-
Filesize
10.8MB