Analysis
-
max time kernel
144s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22/03/2025, 06:15
General
-
Target
b0493b9be59163a45659abbfb522d98b.exe
-
Size
92KB
-
MD5
b0493b9be59163a45659abbfb522d98b
-
SHA1
020f593bf2e2b2b16d11ce9aa1c53a19b64fa163
-
SHA256
0a4d48600d4fdb9bbd4e887e21997daad958d1248f3691d54a1983006f418972
-
SHA512
27ffa99ffbc6bdfc6a12a7261d6d9b14abfe2bb4482b38e1518600e9eea1010d9073a0a99129601820628d8f642b7672e6a2c233541456d6017f2bcfa078d6e9
-
SSDEEP
1536:5fEsW5y1CWyg8d84nv32hSfTS7xNVn7/Ogr0dV8qKmbp5AxB:5fEsA3ng8fugkKxdiqKmbp+
Score
10/10
Malware Config
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0493b9be59163a45659abbfb522d98b.exe"C:\Users\Admin\AppData\Local\Temp\b0493b9be59163a45659abbfb522d98b.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
120KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB