Analysis
-
max time kernel
121s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
22/03/2025, 06:11
General
-
Target
65720da539dfc37aaa5a4ae46f696cb1.exe
-
Size
84KB
-
MD5
65720da539dfc37aaa5a4ae46f696cb1
-
SHA1
efb7e5c2d58fa730104bcbdcf4671338512c8b3f
-
SHA256
98f400fbda00f5ebe20726c6b9162c903133abce2a89649c845911d40590ecef
-
SHA512
b40d1021bae811f6f425b09ecb3613364729e8583be91288b97fdc5609c5c1d944be53134c2d9d6ab0adb67a852e92d7f60a5e38c2416aee1bc9f392497567c2
-
SSDEEP
1536:drqA8L50XtbAvu6lSb+zd82CWt6hyFsTP3OtWdxRYZ8Gbdq5:dqaRlb+p82CbT3OtWdxRnG85
Score
10/10
Malware Config
Extracted
Family
xworm
C2
probably-giants.gl.at.ply.gg:5628
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\65720da539dfc37aaa5a4ae46f696cb1.exe"C:\Users\Admin\AppData\Local\Temp\65720da539dfc37aaa5a4ae46f696cb1.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
112KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB