Analysis
- max time kernel
147s - max time network
154s - platform
windows11-21h2_x64 - resource
win11-20250410-en - resource tags
- submitted
15/04/2025, 16:00
General
- Target file.exe
- Size 1.5MB
- Sample250415-tfxsbatvav
- SHA256 573b6b682ba79aa17aea93a00e8c9f4b3b8d90f177f219682e879bf15c32c55d
Score
10/10
Malware Config
Extracted
Family
-
xworm
Attributes
-
install_file
MasonUSB.exe
Extracted
Family
-
latentbot
C2
-
cryptoghost.zapto.org
Signatures
- Detect Xworm Payload 1 IoCs
- LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
- Latentbot family
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4128-0-0x00007FF8FC343000-0x00007FF8FC345000-memory.dmp
memory/4128-1-0x0000000000120000-0x000000000029E000-memory.dmp
memory/4128-3-0x00007FF8FC340000-0x00007FF8FCE02000-memory.dmp
memory/4128-2-0x00000000024E0000-0x00000000024E6000-memory.dmp
memory/4128-4-0x000000001AF00000-0x000000001AF12000-memory.dmp
memory/4128-5-0x00007FF8FC343000-0x00007FF8FC345000-memory.dmp
memory/4128-6-0x00007FF8FC340000-0x00007FF8FCE02000-memory.dmp