Analysis
-
max time kernel
271s -
max time network
291s -
platform
windows10-ltsc_2021_x64 -
resource
win10ltsc2021-20250314-en -
resource tags
-
submitted
14/03/2025, 19:02
General
-
Target
XClient.exe1.exe
-
Size
33KB
-
MD5
1fe86f0bbb009253ce910b58986a7e3e
-
SHA1
a4d65c837f39c7ab3ccbddad520c85171984d959
-
SHA256
7b79046511bb3e926c5c91db54dae79c06bc19f7d7cdfcfe6df9627eb257cac7
-
SHA512
24034bd34e5dee4a8452c2ca872847ac5eb655a0e5bd4c822c50553e022defecbc58a3cc50d19a0b7b86785841c0d6b7b04f6b483e030cc47ae4bf3aeea8ae6f
-
SSDEEP
768:D+CD9VERUnqNIUoFqimZoVFY9jYOjh4bZ:Dh9VUNITHm0FY9jYOj+9
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
127.0.0.1:7000
87.121.79.75:7000
Mutex
YJMntxWUG8GqfQnk
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe1.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe1.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\WatchOut.ini1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB