Analysis
-
max time kernel
122s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
06/03/2025, 03:00
General
-
Target
2.exe
-
Size
32KB
-
MD5
0348827ff0672fa51903184d58dbb05a
-
SHA1
856266e755be4e749644de4b2983800d272cc64f
-
SHA256
8fb7c15f8e61e7f6016650ed44a7b736254d27eaa9ef5aeed13a60b429e1bcc1
-
SHA512
b949fc474b9bceb95308a8ca6949ddff906e48c8af7c15da229464489bd62c22a3593893569a780df1a27e9d9e6e36d8051cf8d714a50a3f92842811c027378b
-
SSDEEP
768:uVa+vNtg+PB23Tw49FzVFE9jlV7Ojhfbu:gvNtgw23U49HFE9jlV7Oj96
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
172.22.176.1:1177
Mutex
wF5dVYYnCjrDs5P2
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB