Analysis
-
max time kernel
103s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
09/04/2025, 08:25
General
-
Target
4bd46a2850788e5697d214dd4409c063b6f9c38c886443211f22fb0ff19bff9c.exe
-
Size
46KB
-
MD5
bd47ff3ae17aacbd17321862a8c50985
-
SHA1
dfa34d645da8b4910e3fdf523622896ca54ad4f5
-
SHA256
4bd46a2850788e5697d214dd4409c063b6f9c38c886443211f22fb0ff19bff9c
-
SHA512
7dceaf12ca5532ba848be31f531b761549390dfddcc419f81e036509045f5c6ca432e136e77f472ff8109e9a49d7f4445beffce7fca6b418d666f2ec3e6a87e5
-
SSDEEP
768:1eobj+cKJNNn1cBsecfc6hjMeISgFEPa9cAN66iOCh4zjivQx:1Nbj6rrLEUMFJ9P06iOC+u4x
Malware Config
Extracted
xworm
5.0
65.109.33.151:7666
xPSPu8uFVOcl9Vzx
-
Install_directory
%AppData%
-
install_file
XClient.exe
-
telegram
https://api.telegram.org/bot7489241322:AAGq_LvlBfZeerXR2im9ji5u9t22wzfpoqc/sendMessage?chat_id=8123259652
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4bd46a2850788e5697d214dd4409c063b6f9c38c886443211f22fb0ff19bff9c.exe"C:\Users\Admin\AppData\Local\Temp\4bd46a2850788e5697d214dd4409c063b6f9c38c886443211f22fb0ff19bff9c.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
10.8MB