Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
08/03/2025, 05:15
General
-
Target
newr6cheat.exe
-
Size
73KB
-
MD5
a4f24ec80578298dc7bb7f88e222bbb4
-
SHA1
87579941154a573939f33f53ff746131b47a33d6
-
SHA256
6e8e22b394265e77f0b14e9d155642fd2414d20c24764ec7d6b289f35bcc2d30
-
SHA512
2cb3e0897105a2df750333f78f999e71aab33f07a857602eb99ef833f3a354287e6717d781d6ffd386ebe5c4b97f335cdf0bf704ac6a47a08ac244f8be072fc5
-
SSDEEP
1536:okkYku6jLeN1jxqtdbqwqDwvc6Xk+yOy0hjmg4T:vkdK0tdbqiv9iOrdmjT
Score
10/10
Malware Config
Extracted
Family
xworm
C2
127.0.0.1:35845
white-yukon.gl.at.ply.gg:35845
Attributes
-
Install_directory
%ProgramData%
-
install_file
realtek.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\newr6cheat.exe"C:\Users\Admin\AppData\Local\Temp\newr6cheat.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
96KB
-
Filesize
9.9MB
-
Filesize
9.9MB