Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
8s -
max time network
41s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
04/02/2024, 09:05
General
-
Target
SocketHeciServer.exe
-
Size
326KB
-
MD5
b31a895d0c68b927f671ad83cd75746a
-
SHA1
feeeb2c2221b40f07eb5f8a61b42fa74b515777d
-
SHA256
dfffdd9f71b964ea17dec2660be833b0ecf007e239a3e44f4b8108967557d78a
-
SHA512
7dde6e228200f7776d5ed2414e4fc1c19f487f8a77719f0af87ad612f605dcc87bd525192d3819c8eb022a9d9e563ab87308d6c08adc70cece6f7b83b2e99e93
-
SSDEEP
6144:sjJL98jtwguKV5BwUnZqazMhD9RLJt88sndcP8pPyDvUGOksDRb:DjtkKLBwiZlzMB9xgndcP88DvvP
Score
10/10
Malware Config
Extracted
Family
xworm
Version
3.1
C2
209.25.143.223:505
Attributes
-
install_file
game.exe
aes.plain
Signatures
-
Detect Xworm Payload 2 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SocketHeciServer.exe"C:\Users\Admin\AppData\Local\Temp\SocketHeciServer.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
140KB
-
Filesize
4KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
248KB
-
Filesize
760KB
-
Filesize
344KB
-
Filesize
10.8MB
-
Filesize
112KB
-
Filesize
2.0MB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
760KB
-
Filesize
256KB
-
Filesize
2.0MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
168KB
-
Filesize
168KB