Analysis
-
max time kernel
143s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
06/04/2025, 11:50
General
-
Target
XClient.exe
-
Size
51KB
-
MD5
2787d9e8a64842885ebd6550255c6202
-
SHA1
c7f33c3d403b424dc391a461d2c7a905314d4812
-
SHA256
e6723248680578bc5be79251443739e1c7fac8ba1e5001a8341c77e3ffa6b2bc
-
SHA512
63f22df446e975bdf19e9dfad802a72516b869f75842fa1a1e6c6575c595589d9e65d3dfe5ce41d9bf70566cf8b2fda87762da160a1e684b96f5ce425b049504
-
SSDEEP
1536:JHpyf3bFAkbN8tGgQLlvz8jLZplO7t3J6K33:JQjCkbCt7c8LZplO7tZJ
Score
10/10
Malware Config
Extracted
Family
xworm
C2
127.0.0.1:80
Attributes
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
80KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB