Analysis
-
max time kernel
16s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
05/03/2025, 22:47
General
-
Target
XClient.exe
-
Size
210KB
-
MD5
6f44d5dd4b1fb7c1d2aaefa76c078a22
-
SHA1
d4f08c5390c240e9b049d17d9e194143cff780df
-
SHA256
cf964077390a9d3ae946829975483f8aae1da1cd2a0385cc66107e4b84e56a18
-
SHA512
12ef5efa88531b62961d2f13ab32a9b1fb6ba39eca6d2916d217a73765adfe62f4438d2e4b70032aee1f0b376082a633b2cab8082170007d2a8d51a8f0e45824
-
SSDEEP
3072:oKikaK+b/lP5o74RkpOIhIW+xRUGKXs+S++7KFSbxeY+qDDrMr:okaK+b/Z8X60GqStKEbxI
Score
10/10
Malware Config
Extracted
Family
xworm
C2
147.185.221.26:38655
Attributes
-
Install_directory
%AppData%
-
install_file
♬ ♬.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
232KB
-
Filesize
9.9MB
-
Filesize
9.9MB