Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
07/03/2025, 21:59
General
-
Target
Shutdown35t.exe
-
Size
221KB
-
MD5
ae15e1bf1795dd35218d846fac9e35d6
-
SHA1
cb1866ebc01da9d76ab09222a8de0201d300043d
-
SHA256
39cbffe1dae6d97aeb9f23aab673e454859b67c7e28cf7aca7b7f9db3e5da3fd
-
SHA512
cf89b9ecad50be66b9aced5d5346daa86736da511be23e6e4543e15b030226c01e7b7354d45071424efe2c7bc4d56f34b166139c664eaf79eb518fcb55db1657
-
SSDEEP
3072:UzdXlxb0JKBCbUVUysblO6im9co0PcpYL1PFG5KH8HFOQMmLtT:UxXn0JKobhysbT1+EpiOv4
Score
10/10
Malware Config
Extracted
Family
xworm
C2
127.0.0.1:47348
approved-shooting.gl.at.ply.gg:47348
Attributes
-
Install_directory
%Userprofile%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shutdown35t.exe"C:\Users\Admin\AppData\Local\Temp\Shutdown35t.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
240KB
-
Filesize
9.9MB
-
Filesize
9.9MB