Analysis
-
max time kernel
89s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
22/03/2025, 06:25
General
-
Target
337f25a258012c5c5802696b2f2b1a51.exe
-
Size
322KB
-
MD5
337f25a258012c5c5802696b2f2b1a51
-
SHA1
06269501194236c5086c4883e169b17d9202e685
-
SHA256
85fa680ff456723ad6dbcbc48f9e5baad961aa7d67143bf5e277268be7035a1f
-
SHA512
9289327fa5c573c0a4c8998ddad6a5740c887302053c30a3c1e1eb8246501305f3e63d63ad7abb9c6f20be42790c37dddcd8e88ec01590db345ad70528f50bfd
-
SSDEEP
6144:ejWTebuRcLMjH5WBz2YT7jRhMV1gEpkNkMdP+D202ZDa:kWTzcLMjH5GSpjGP+I
Score
10/10
Malware Config
Extracted
Family
xworm
C2
gas-representative.gl.at.ply.gg:28749
Attributes
-
Install_directory
%AppData%
-
install_file
system.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\337f25a258012c5c5802696b2f2b1a51.exe"C:\Users\Admin\AppData\Local\Temp\337f25a258012c5c5802696b2f2b1a51.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
344KB
-
Filesize
9.9MB
-
Filesize
9.9MB