Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
22/03/2025, 06:17
General
-
Target
055434cfbf05d012a80abe18c0849d10.exe
-
Size
32KB
-
MD5
055434cfbf05d012a80abe18c0849d10
-
SHA1
f624197f1842029b1a8715e6b78de472169d54b5
-
SHA256
2d59e444a2f354a122d379befc343b3448fa9a38207fee810a7d323b9752c873
-
SHA512
9e1383659ee465f37e120b554ba6d36340449698030913d48746e0f48e7e6cda2b8634e47c8121263fb49f591b8835907a0440310decad8368802ca47a168cb3
-
SSDEEP
384:wEbmX5Qa+vN1h1+X3v6JFjL+g93Tm2eaFOL1dRApkFTBLTsOZwpGd2v99IkuisBi:1Va+vNtg+PB93Tw4e1dVFE9j0Ojhmb6
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
164.92.163.239:2382
Mutex
snqun1p1UReEjGlM
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\055434cfbf05d012a80abe18c0849d10.exe"C:\Users\Admin\AppData\Local\Temp\055434cfbf05d012a80abe18c0849d10.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
10.8MB