Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
157s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
-
submitted
17/06/2024, 08:03
General
-
Target
XClient.exe
-
Size
198KB
-
MD5
693eab8d1fc381f15991e28fe37791b8
-
SHA1
e399c9c483cfd4402b3bf8e7cd8982e1958922d7
-
SHA256
d4a884ccc0c777e8d3cac9bd295836bdcd22f3eba2a2081981731435ffee9249
-
SHA512
cc90816980edfa15cd617f515c04125da99c270d5c8cc974c4e7724b06b0ad05f6f4406f803d5fd0fdb76aeb0493f4c2be1bda4acf8d97e1a8afdcccac448dfb
-
SSDEEP
3072:8xA3J9nWFM9FBOjP8SKfbzxcwg7es6/Vsb8VKTup49oJMfF/H9N3Ky9NzLnK:L6M96UhcX7elbKTuq9bfF/H9d9n
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
127.0.0.1:7000
Jamalhacker-24499.portmap.host:7000
Mutex
6cN97DAMI538yz6U
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB