Analysis
-
max time kernel
92s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
06/03/2025, 00:25
General
-
Target
bad804436fdffd9399bff8fe714756b62e5b6506da2d5ab8cca56865d3d822d2.exe
-
Size
167KB
-
MD5
182b050b7db65d4036ab030adaa255b0
-
SHA1
5f7a4ee3c631e7fe4800aaa74cbc76d8f9a9c034
-
SHA256
bad804436fdffd9399bff8fe714756b62e5b6506da2d5ab8cca56865d3d822d2
-
SHA512
45724a6a5639fe35854cd63a7ff8769283dc1452d70458c51533ebbf89950ec91ca7896c5388e2ff722cde612f58b60f31630d67cd5dadbf25ee67ea52bedb46
-
SSDEEP
3072:AvOGEcyb1zL9RzsOvfPITBz65/M6If+3Js+3JFkKeTn1:AJTybV9RtgTxBt25
Score
10/10
Malware Config
Extracted
Family
xworm
C2
independent-money.gl.at.ply.gg:21593
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bad804436fdffd9399bff8fe714756b62e5b6506da2d5ab8cca56865d3d822d2.exe"C:\Users\Admin\AppData\Local\Temp\bad804436fdffd9399bff8fe714756b62e5b6506da2d5ab8cca56865d3d822d2.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
192KB
-
Filesize
10.8MB
-
Filesize
1.0MB
-
Filesize
10.8MB