Analysis
-
max time kernel
129s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
05/03/2025, 22:28
General
-
Target
.exe
-
Size
32KB
-
MD5
d5c3a2612efab83142854b2b5d141959
-
SHA1
406be7ccdfbbd1311b30a3f6201c0065ee3b15f5
-
SHA256
2f9dc0b8c5a949f7778de3d67a2696f8b9ee652a09ceeb4fe44ccef16a03d8cc
-
SHA512
93c41405cc5ad328db240457feffbd22abb8703f8f3260837bd91705f9152ce38f6b97b5afb9a7dbebdd6eea4f00e04732ab699b19f58e7e24a6d70074476768
-
SSDEEP
384:GEbmX5Qa+vN1h1+X3v6JFjL+gH3Tm2eaFOYKdRApkFTBLTsOZwpGd2v99IkuisDq:fVa+vNtg+PBH3Tw4xKdVFE9jmOjhkbM
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
26.ip.gl.ply.gg:1499
Mutex
c4cJSkhIzc81X8EI
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\.exe"C:\Users\Admin\AppData\Local\Temp\.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB