Analysis
-
max time kernel
140s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22/03/2025, 06:09
General
-
Target
30143fedf8d4f08b82ae24f18f50e5ac.exe
-
Size
53KB
-
MD5
30143fedf8d4f08b82ae24f18f50e5ac
-
SHA1
e31de66bbdf8aad355a6e8c6c98f591ba2d1d8ff
-
SHA256
8b05a54bc8f930d8a9ed6db438e3bbff857b5a65cc309195f884e177f1cae263
-
SHA512
cbc44f3681145245354d23adc979f224c05e34dfeadad0c74a800c278616f59c4f4b9e545079e840a1cc9aa7bbf2ffd776569820a0410561f0b00b159fd1759e
-
SSDEEP
768:a4jAmlg/qrWt05vQ7z2TRl3XOnn+G/kboEP0rZDY2Trm0pdSmifj6YOHSJNhwFI0:a+AEgAcYv8xkboK3sDpd+7lOHYNv6
Score
10/10
Malware Config
Extracted
Family
xworm
C2
26.ip.gl.ply.gg:53142
Attributes
-
Install_directory
%Temp%
-
install_file
svchost.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Drops startup file 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\30143fedf8d4f08b82ae24f18f50e5ac.exe"C:\Users\Admin\AppData\Local\Temp\30143fedf8d4f08b82ae24f18f50e5ac.exe"1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
80KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB