Analysis
-
max time kernel
891s -
max time network
428s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
06/03/2025, 13:27
General
-
Target
wad.exe
-
Size
140KB
-
MD5
c99f3f8298b973b58d216288fefccc0a
-
SHA1
ca849ae90f4df0f7951a1fa6943fe526c4cdbe9c
-
SHA256
26653dd95cf0c35f757494fee76478a0532331e6271c323ebd2ee10d99c2804d
-
SHA512
edae505b9f591061df6ef16041551c07fca169f058a781ec103e0acb9589df7f93d0200a064549cd0b003becbbdd417155e438c6fe36e7f3a3f3c7740be4bbd7
-
SSDEEP
768:JkIFS2U1zigDKNgAWMLxOchH5Ft93vO+hmNFiD621sIwEk4w00wm:u6SoeIVhZFt93vO+INYWEC
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
127.0.0.1:7000
Mutex
Au6cWZUCNAOIflwB
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\wad.exe"C:\Users\Admin\AppData\Local\Temp\wad.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
160KB
-
Filesize
10.8MB
-
Filesize
10.8MB