Analysis
-
max time kernel
93s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
04/03/2025, 20:02
General
-
Target
Robux Generator.exe
-
Size
45KB
-
MD5
161ca9a58355ddb2726e250045f5a476
-
SHA1
4573dd2df8a86e65d3727920b29ac6729b565e11
-
SHA256
cfb7273e97219426b9d69c0a0b0130f1a9fb59b1de6eb003622ca3017818ef8d
-
SHA512
d19d4812a293d0b00250446b0d814c7005692c66246ee7bd63c5867a9a0656b1661c81862e89f9b117dc40269e2c2a5bedbf7423f1a68bdae524de5c916a3fe1
-
SSDEEP
768:jwh8ooVSFF0eObAvrSH7tF5Pa9qkcOwhY3/mXXyhgYQG:ZooVW0Av6xF49qkcOwy+XanX
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
127.0.0.1:7000
Mutex
dlCpvOUBZJ74DV3m
Attributes
-
Install_directory
%LocalAppData%
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Robux Generator.exe"C:\Users\Admin\AppData\Local\Temp\Robux Generator.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB