Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
04/03/2025, 17:59
General
-
Target
XClient.exe
-
Size
38KB
-
MD5
f06449aeba429edebe5548a8d8c69c20
-
SHA1
7992d6ca53f7f864e7e8c35fabd8977f12501fce
-
SHA256
07103092725f8ea44b8c873d6d2db637453fffc42d05d0f3e02a51f05abce115
-
SHA512
3252e3d70e6af7c1c709682c8ecf9f6fcd37d2db74d12605d82acf99923c36b33bb1165560b4b3616fac51c4b6f2519960e32a41d3fc4d7cba72734df997fe92
-
SSDEEP
768:Qcf8pTYPfbEpjYnVQWbFo9BLMKA6+OwhxMvFG:QKEYX4SxFo9BLA6+OwQM
Score
10/10
Malware Config
Extracted
Family
xworm
Version
3.1
C2
newsletter-effects.gl.at.ply.gg:42069
Mutex
OUUT3AwKbkkDRPZO
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
9.9MB