Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows11-21h2_x64 -
resource
win11-20250410-en -
resource tags
-
submitted
15/04/2025, 16:00
General
-
Target
file.exe
-
Size
1.5MB
-
MD5
331c0633d4eaecd87c39180f7f350769
-
SHA1
7339299f301e2bf82989029391366da000f53bc6
-
SHA256
573b6b682ba79aa17aea93a00e8c9f4b3b8d90f177f219682e879bf15c32c55d
-
SHA512
7edb099b0566bdb365545bf3f5f28e937141eb3eacf33877ee1f2d1aee65fe429a741aba03bbd92d37a1e93ff5f8fe18ea4d53b957abb06e40c598495fcfaec7
-
SSDEEP
24576:fBGIMKfL6k4fP133M+Rvf9rJ9UpENLKmgUmVGn0LQ:fBGIrfL6kIP133TR39rPUGNLKmegn0L
Score
10/10
Malware Config
Extracted
Family
xworm
Attributes
-
install_file
MasonUSB.exe
Extracted
Family
latentbot
C2
cryptoghost.zapto.org
Signatures
-
Detect Xworm Payload 1 IoCs
-
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
-
Latentbot family
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
1.5MB
-
Filesize
10.8MB
-
Filesize
24KB
-
Filesize
72KB
-
Filesize
8KB
-
Filesize
10.8MB