Analysis
-
max time kernel
139s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
06/03/2025, 13:52
General
-
Target
sadasdasdasdasdas.exe
-
Size
42KB
-
MD5
3137c79a207244b4ffd8f47a280d6946
-
SHA1
3694dd6f44949f6bf681b8a69410118033fe0368
-
SHA256
d326364bd2e12c39ccb4b775a800b1e52111debaf2cfff0d0c020e06de4bf0c1
-
SHA512
e9362eeca845a3c7491dcb5824fbe282815cb15d343b9b5e7db8be609ec09dac0962d4536d582c3f845b31b33b7872d3be5e433aba75bbf3856136f2fd941e67
-
SSDEEP
768:ie2H+qvxFTOGo7ZQumhPMCYWGNthRQJMeZIF+0C9o/HhpjO+hJPbCPt8:J2H+q7TOFShECzGJRiUFu9oZNO+nct8
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
Mutex
sjCLxqdf2jeq4aWq
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\sadasdasdasdasdas.exe"C:\Users\Admin\AppData\Local\Temp\sadasdasdasdasdas.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB