Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
27s -
max time network
17s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
02/08/2024, 22:11
General
-
Target
XClient.exe
-
Size
33KB
-
MD5
48b9cdcb33c1a29398056d35bfa0645a
-
SHA1
d5bc1feec8b196005e733be26891ad7468f3aaf7
-
SHA256
3fa216500c3adc0968a049701032789556cd2abaabfdfcc8eb2ac8e05a01cf43
-
SHA512
42f2334faba03cef90242d5ff24fdbc8870c7f187388adf08836885d724cdb5a236285453d56a0a53dd5222de546e7e59279face8980c97c8099cda3ddb69dcb
-
SSDEEP
384:/E8PQ9Ba+vNuntf98d6ILj7CM42pfL3iB7OxVqWYRApkFXBLTsOZwpGN2v99Ikui:PUa+vNohsXn42JiB706VF49jHOjhkbz
Malware Config
Extracted
Family
xworm
Version
5.0
C2
127.0.0.1:8888
Mutex
9uBvYg0Ptt9Hc8LV
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/2216-1-0x0000000000A40000-0x0000000000A4E000-memory.dmp family_xworm -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2216 XClient.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2216
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1340