Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04/03/2025, 22:26
General
-
Target
2025-03-04_6803215592fd9cd6ffb299385dc44b8e_hiddentear.exe
-
Size
151KB
-
MD5
6803215592fd9cd6ffb299385dc44b8e
-
SHA1
9bdb0356393386162063ea6f9cd5f72b51119264
-
SHA256
04c75c092c9f64493318740487b08858644373a3b9f4c549f9cd2b25ea60d548
-
SHA512
c46ec6fea4781072d80c383757da4475c2a983c411c61bfb784b64c294bfafaa343b8176b22697666c3c1fa7d4c01a074cf163c9c4f30b3ff0b8e03c435e9b2b
-
SSDEEP
3072:exNg5f/SLXkbvhPOpCM+lmsolAIrRuw+mqv9j1MWLQA:eQyUbK+lDAA
Score
10/10
Malware Config
Extracted
Family
xworm
C2
135.148.125.190:46613
Attributes
-
Install_directory
%Temp%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Drops startup file 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-04_6803215592fd9cd6ffb299385dc44b8e_hiddentear.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-04_6803215592fd9cd6ffb299385dc44b8e_hiddentear.exe"1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
176KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB