Analysis
-
max time kernel
117s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21/03/2025, 08:06
General
-
Target
xpmg.exe
-
Size
10.9MB
-
MD5
73e43654e9f3df0d07d25051b2d3cfeb
-
SHA1
6eebcc3ab72ea0eeb5b9d3340145b41bea23423b
-
SHA256
666944b19c707afaa05453909d395f979a267b28ff43d90d143cd36f6b74b53e
-
SHA512
871600ae79b26bde4b5601fcf3c9e2e3d2a9f9bc04cd06d10cf69036a714a5b89b811da07070e021e7d844fc8c57a406e17361e8f738b1068b24d989e40e659c
-
SSDEEP
196608:KoykUxv987qMNR4Ok/RDpgPnqSuR3pfRkAJ:7UxFUqMNR4Ok5DpgPnqSuR3pfRf
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 13 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\xpmg.exe"C:\Users\Admin\AppData\Local\Temp\xpmg.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken