Analysis
-
max time kernel
143s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22/03/2025, 06:12
General
-
Target
6f7e5a757226029c4770683df8125105.exe
-
Size
32KB
-
MD5
6f7e5a757226029c4770683df8125105
-
SHA1
a02af7730ecfa6e29cb084d4540684f8f03eddd0
-
SHA256
20e2cc8b8326e1050bec8103b99c08c89982555c6731fa4b06e0ba6c4789e53f
-
SHA512
b93f60d1ed745df8774b81285da2d3a857a46b3a177253a314d583f74fcc62a1d1bfd4f4d2fd549a977c9dd375d75aa5aa45f2f3c0df9794aff55a3a4412627d
-
SSDEEP
384:EcmKc71F3BUaMbGf/JLbFt63Tm2eaFOYKdRApkFTBLTsOZwpGd2v99Ikuis1izV+:5a1LxMC1Jt63Tw4xKdVFE9jVOjhIbw
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
127.0.0.1:5574
sets-fatty.gl.at.ply.gg:5574
Mutex
b3PIGP4IGis5HwSz
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f7e5a757226029c4770683df8125105.exe"C:\Users\Admin\AppData\Local\Temp\6f7e5a757226029c4770683df8125105.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
9.9MB
-
Filesize
9.9MB