Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
06/03/2025, 13:09
General
-
Target
cheatengine.exe
-
Size
42KB
-
MD5
fe3ecd7a7068b85e5c1a1c8833e1b5ac
-
SHA1
ebbd9a0b9f54fe308f1a40bd737deeb812f34415
-
SHA256
42a43122a976de6400853bcb4d91eb6fc01b33e323e9c44e9d4740c978180a8e
-
SHA512
87f75872aa6630d5093b2065ab6fc0f80d981ddbbddaef339d99f5a6a3e18e4313f502b300d468ac248e4ad807852c3732c554541e6d83e63165108b12e04c76
-
SSDEEP
768:+RPD9OQhx/BZ3Tw4xKdVFE9jffOjhBbAds4S1EAd8II1:+d9OW/Z3U4xcFE9jffOjP0dS1EAd8II1
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
Idlerkik-51025.portmap.host:51025
Mutex
a1yX5464i0yhChwC
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cheatengine.exe"C:\Users\Admin\AppData\Local\Temp\cheatengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB