xworm | 1666023af8ed0e8309b9da94d5235bb1cedfe7615cc7394e2bfbac7649a4a100

Analysis

max time kernel
144s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 19:36

Target

XClient.exe
Size

42KB
MD5

b2e982bf2e6dc826a4da1cea54ee76af
SHA1

09f986c6ccc76c76404953f736fdfa588a3061dc
SHA256

1666023af8ed0e8309b9da94d5235bb1cedfe7615cc7394e2bfbac7649a4a100
SHA512

ea6e3c7d64148308c7cb91ff2c1f29d86a607f5f9540b981210f7d92ce56c5bd326cdb993c6775be110ea8c70a1bafed2293a8c55f42b9cdf6b18f152ca219c3
SSDEEP

768:PVa+vNtg+PB93Tw4fBdVFE9jaXOjhUbEds4S1EAd8IIR:nvNtgw93U4f1FE9jaXOj6odS1EAd8IIR

Score

10^/10

Family

xworm

Version

5.0

127.0.0.1:7000

Mutex

X2VM6nc1CL9WRMYl

Attributes

aes.plain

Detect Xworm Payload 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/1700-1-0x0000000000BF0000-0x0000000000C00000-memory.dmp family_xworm
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

XClient.exe

description pid process

Token: SeDebugPrivilege 1700 XClient.exe

resource	yara_rule
behavioral1/memory/1700-1-0x0000000000BF0000-0x0000000000C00000-memory.dmp	family_xworm

description	pid	process
Token: SeDebugPrivilege	1700	XClient.exe

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1700

memory/1700-0-0x000007FEF5693000-0x000007FEF5694000-memory.dmp

Filesize
4KB

Download
memory/1700-1-0x0000000000BF0000-0x0000000000C00000-memory.dmp

Filesize
64KB

Download
memory/1700-2-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

Filesize
9.9MB

Download
memory/1700-3-0x000007FEF5693000-0x000007FEF5694000-memory.dmp

Filesize
4KB

Download
memory/1700-4-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

Filesize
9.9MB

Download