Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20250207-en -
resource tags
-
submitted
06/03/2025, 12:44
General
-
Target
CHEATNEPIZDI.exe
-
Size
197KB
-
MD5
48c8a6d100fb89f92a8080697133d77f
-
SHA1
19c8b82c1164575b88abea63cbff500fd5ec26b7
-
SHA256
622cc6e79e17696dc0c8a621677765cabe8b48ce5d40881bf71b463223e16364
-
SHA512
e440057421e96a2ed3043a828ffe9b0738c1c532d9bb63d214e8809a1e2d779e38e2b0cab3f539acac44216753fe7b47f8109e5ec7578873f6efc7a150630549
-
SSDEEP
3072:Yd9xkHFE9jnOjE8SKfbzxcwg7es6/Vsb8VKTup49oJMfF/H9N3Ky9NzLnj:Y6E9XUhcX7elbKTuq9bfF/H9d9n
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
ohsorry-20836.portmap.host:20836
Mutex
WHNildkiUcLMmL9K
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CHEATNEPIZDI.exe"C:\Users\Admin\AppData\Local\Temp\CHEATNEPIZDI.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
216KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
48KB