Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

48f18ae615...cf.exe

windows7-x64

10

48f18ae615...cf.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    06/06/2024, 01:16 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    48f18ae61538c79d3d5ab7663c621b6d08e0f6413d6c7c13b10dc12a7c6027cf.exe

  • Size

    76KB

  • MD5

    781a598560272296fa31f3f936c02cc7

  • SHA1

    b2ffa56d82455ee07ae4614619fb98a98a6f1a76

  • SHA256

    48f18ae61538c79d3d5ab7663c621b6d08e0f6413d6c7c13b10dc12a7c6027cf

  • SHA512

    b17dbd705b6a7e58855839625484a073b36ecaa5cb9520e4f857f964b13c0b8b609e7e7f67d4873e70e2ef753630b314d9607338cc048a249db55fb0dbaa6e23

  • SSDEEP

    1536:SAArKmiQ6kQVEX2VBxoPsSxYTbA2jPntlL1vsUCtsA+OmPq8vxED:S/r7QHvxusCYTbAofbhvs3sJOmvG

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

C2

fresh-impala-19.telebit.io:8634

Attributes
  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Detects Windows executables referencing non-Windows User-Agents 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\48f18ae61538c79d3d5ab7663c621b6d08e0f6413d6c7c13b10dc12a7c6027cf.exe
    "C:\Users\Admin\AppData\Local\Temp\48f18ae61538c79d3d5ab7663c621b6d08e0f6413d6c7c13b10dc12a7c6027cf.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1996

Network

  • flag-us
    DNS
    ip-api.com
    48f18ae61538c79d3d5ab7663c621b6d08e0f6413d6c7c13b10dc12a7c6027cf.exe
    Remote address:
    8.8.8.8:53
    Request
    ip-api.com
    IN A
    Response
    ip-api.com
    IN A
    208.95.112.1
  • flag-us
    GET
    http://ip-api.com/line/?fields=hosting
    48f18ae61538c79d3d5ab7663c621b6d08e0f6413d6c7c13b10dc12a7c6027cf.exe
    Remote address:
    208.95.112.1:80
    Request
    GET /line/?fields=hosting HTTP/1.1
    Host: ip-api.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Thu, 06 Jun 2024 01:16:49 GMT
    Content-Type: text/plain; charset=utf-8
    Content-Length: 6
    Access-Control-Allow-Origin: *
    X-Ttl: 58
    X-Rl: 43
  • flag-us
    DNS
    fresh-impala-19.telebit.io
    48f18ae61538c79d3d5ab7663c621b6d08e0f6413d6c7c13b10dc12a7c6027cf.exe
    Remote address:
    8.8.8.8:53
    Request
    fresh-impala-19.telebit.io
    IN A
    Response
    fresh-impala-19.telebit.io
    IN CNAME
    sfo3.telebit.cloud
    sfo3.telebit.cloud
    IN A
    209.38.154.253
  • 208.95.112.1:80
    http://ip-api.com/line/?fields=hosting
    http
    48f18ae61538c79d3d5ab7663c621b6d08e0f6413d6c7c13b10dc12a7c6027cf.exe
    264 B
     307 B
     4
    3

    HTTP Request

    GET http://ip-api.com/line/?fields=hosting

    HTTP Response

    200
  • 209.38.154.253:8634
    fresh-impala-19.telebit.io
    48f18ae61538c79d3d5ab7663c621b6d08e0f6413d6c7c13b10dc12a7c6027cf.exe
    152 B
     120 B
     3
    3
  • 209.38.154.253:8634
    fresh-impala-19.telebit.io
    48f18ae61538c79d3d5ab7663c621b6d08e0f6413d6c7c13b10dc12a7c6027cf.exe
    152 B
     120 B
     3
    3
  • 209.38.154.253:8634
    fresh-impala-19.telebit.io
    48f18ae61538c79d3d5ab7663c621b6d08e0f6413d6c7c13b10dc12a7c6027cf.exe
    152 B
     120 B
     3
    3
  • 209.38.154.253:8634
    fresh-impala-19.telebit.io
    48f18ae61538c79d3d5ab7663c621b6d08e0f6413d6c7c13b10dc12a7c6027cf.exe
    152 B
     120 B
     3
    3
  • 209.38.154.253:8634
    fresh-impala-19.telebit.io
    48f18ae61538c79d3d5ab7663c621b6d08e0f6413d6c7c13b10dc12a7c6027cf.exe
    152 B
     120 B
     3
    3
  • 209.38.154.253:8634
    fresh-impala-19.telebit.io
    48f18ae61538c79d3d5ab7663c621b6d08e0f6413d6c7c13b10dc12a7c6027cf.exe
    152 B
     120 B
     3
    3
  • 209.38.154.253:8634
    fresh-impala-19.telebit.io
    48f18ae61538c79d3d5ab7663c621b6d08e0f6413d6c7c13b10dc12a7c6027cf.exe
    152 B
     120 B
     3
    3
  • 209.38.154.253:8634
    fresh-impala-19.telebit.io
    48f18ae61538c79d3d5ab7663c621b6d08e0f6413d6c7c13b10dc12a7c6027cf.exe
    152 B
     120 B
     3
    3
  • 209.38.154.253:8634
    fresh-impala-19.telebit.io
    48f18ae61538c79d3d5ab7663c621b6d08e0f6413d6c7c13b10dc12a7c6027cf.exe
    152 B
     120 B
     3
    3
  • 209.38.154.253:8634
    fresh-impala-19.telebit.io
    48f18ae61538c79d3d5ab7663c621b6d08e0f6413d6c7c13b10dc12a7c6027cf.exe
    152 B
     120 B
     3
    3
  • 209.38.154.253:8634
    fresh-impala-19.telebit.io
    48f18ae61538c79d3d5ab7663c621b6d08e0f6413d6c7c13b10dc12a7c6027cf.exe
    152 B
     120 B
     3
    3
  • 209.38.154.253:8634
    fresh-impala-19.telebit.io
    48f18ae61538c79d3d5ab7663c621b6d08e0f6413d6c7c13b10dc12a7c6027cf.exe
    152 B
     120 B
     3
    3
  • 209.38.154.253:8634
    fresh-impala-19.telebit.io
    48f18ae61538c79d3d5ab7663c621b6d08e0f6413d6c7c13b10dc12a7c6027cf.exe
    152 B
     80 B
     3
    2
  • 209.38.154.253:8634
    fresh-impala-19.telebit.io
    48f18ae61538c79d3d5ab7663c621b6d08e0f6413d6c7c13b10dc12a7c6027cf.exe
    152 B
     120 B
     3
    3
  • 209.38.154.253:8634
    fresh-impala-19.telebit.io
    48f18ae61538c79d3d5ab7663c621b6d08e0f6413d6c7c13b10dc12a7c6027cf.exe
    152 B
     120 B
     3
    3
  • 209.38.154.253:8634
    fresh-impala-19.telebit.io
    48f18ae61538c79d3d5ab7663c621b6d08e0f6413d6c7c13b10dc12a7c6027cf.exe
    152 B
     120 B
     3
    3
  • 209.38.154.253:8634
    48f18ae61538c79d3d5ab7663c621b6d08e0f6413d6c7c13b10dc12a7c6027cf.exe
  • 8.8.8.8:53
    ip-api.com
    dns
    48f18ae61538c79d3d5ab7663c621b6d08e0f6413d6c7c13b10dc12a7c6027cf.exe
    56 B
     72 B
     1
    1

    DNS Request

    ip-api.com

    DNS Response

    208.95.112.1

  • 8.8.8.8:53
    fresh-impala-19.telebit.io
    dns
    48f18ae61538c79d3d5ab7663c621b6d08e0f6413d6c7c13b10dc12a7c6027cf.exe
    72 B
     120 B
     1
    1

    DNS Request

    fresh-impala-19.telebit.io

    DNS Response

    209.38.154.253

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1996-0-0x000007FEF56E3000-0x000007FEF56E4000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1996-1-0x0000000000C60000-0x0000000000C7A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/1996-2-0x000007FEF56E0000-0x000007FEF60CC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1996-3-0x000007FEF56E3000-0x000007FEF56E4000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1996-4-0x000007FEF56E0000-0x000007FEF60CC000-memory.dmp

    Filesize

    9.9MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.