Analysis
-
max time kernel
139s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
15/03/2025, 03:05
General
-
Target
7b79046511bb3e926c5c91db54dae79c06bc19f7d7cdfcfe6df9627eb257cac7.exe
-
Size
33KB
-
MD5
1fe86f0bbb009253ce910b58986a7e3e
-
SHA1
a4d65c837f39c7ab3ccbddad520c85171984d959
-
SHA256
7b79046511bb3e926c5c91db54dae79c06bc19f7d7cdfcfe6df9627eb257cac7
-
SHA512
24034bd34e5dee4a8452c2ca872847ac5eb655a0e5bd4c822c50553e022defecbc58a3cc50d19a0b7b86785841c0d6b7b04f6b483e030cc47ae4bf3aeea8ae6f
-
SSDEEP
768:D+CD9VERUnqNIUoFqimZoVFY9jYOjh4bZ:Dh9VUNITHm0FY9jYOj+9
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
127.0.0.1:7000
87.121.79.75:7000
Mutex
YJMntxWUG8GqfQnk
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b79046511bb3e926c5c91db54dae79c06bc19f7d7cdfcfe6df9627eb257cac7.exe"C:\Users\Admin\AppData\Local\Temp\7b79046511bb3e926c5c91db54dae79c06bc19f7d7cdfcfe6df9627eb257cac7.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
10.8MB