Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
06/03/2025, 14:45
General
-
Target
Nursultan 1.12.2-1.16.5 Crack/CrackLauncher.exe
-
Size
42KB
-
MD5
4f7d0cb075b81a3923661409b47e8a31
-
SHA1
d3aa635fedd9adff2a821fa20e7f8b9fac838ed4
-
SHA256
4e3b031bcd6552a48501e629c37e53d58721cde1b494ee96f8ba9473be7ff6d6
-
SHA512
3e3fea0be7af651bb2b7eba42543112912808931a9f8f84e7ab8f424910b190c113a99bf4859d032bc0ae3478398b93ffe5d025b7dc1dffe37111ea6d3e7a66e
-
SSDEEP
768:oTafJRPSlKSmUO2DXFyp9ORLM56YOjhWPyVGO:oTKJqm2TF09MLg6YOj0JO
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
Idlerkik-51025.portmap.host:51025
Mutex
rSFFOfqaVoKkdUae
Attributes
-
Install_directory
%AppData%
-
install_file
svhost.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.12.2-1.16.5 Crack\CrackLauncher.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.12.2-1.16.5 Crack\CrackLauncher.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB