Analysis
-
max time kernel
15s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
06/03/2025, 23:26
General
-
Target
triggerbot.exe
-
Size
66KB
-
MD5
3c29f913ec259219393ed6ed34095f7f
-
SHA1
a44d686af7756b548373525b3cb921c44d0b67b2
-
SHA256
e65c82b121ec90f36fc4193e8e7f850312107c441e8a2cfa4e6b844cb6462485
-
SHA512
3a3e5a676a0541b9d5697c5f6f7b71deadae1e9633ff919cfdf68f9288f4b5dfb91c38a6af0fbbe23aaab5d08e1b6f409bf33134390a54ca023c916f3d5ecf50
-
SSDEEP
1536:vFVqX0n8XtajJvNDbsPSKoZr66tFOgUu9x6:9Yq8XQBbsT0FO7j
Score
10/10
Malware Config
Extracted
Family
xworm
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
-
pastebin_url
https://pastebin.com/raw/kU06s0Rk
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\triggerbot.exe"C:\Users\Admin\AppData\Local\Temp\triggerbot.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
9.9MB
-
Filesize
9.9MB