Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
06/03/2025, 15:02
General
-
Target
OCYMF_XClient.exe
-
Size
197KB
-
MD5
947531e390d56a33db1c5fac201f3d6e
-
SHA1
6890af0bf097ca3dbf3a979251e8e9655a0d28c9
-
SHA256
e98dc3272849a4feef91b79b5f4ceb5a5caeeb67c0ace7b951e719e4c56dc4b9
-
SHA512
36c81a7b5ad59952e0e084df7601e14e2f4ac5530dd2937ab90f7f7693297f9776f6e970905f35cf058b76d5c3a465a112276d6426fe6527b8596504292df3e0
-
SSDEEP
3072:Qd9KkHFE9jNOjn8SKfbzxcwg7es6/Vsb8VKTup49oJMfF/H9N3Ky9NzLnK:QrE92UhcX7elbKTuq9bfF/H9d9n
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
ohsorry-20836.portmap.host:20836
Mutex
p0RlYlnzEbgzdE3a
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\OCYMF_XClient.exe"C:\Users\Admin\AppData\Local\Temp\OCYMF_XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
216KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB