Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
27s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2024, 12:10
Behavioral task
behavioral1
Sample
XClient.exe
Resource
win7-20240729-en
3 signatures
30 seconds
General
-
Target
XClient.exe
-
Size
30KB
-
MD5
20648ba8bb78f73742b3053ad59d3a4c
-
SHA1
ff09b9288194ad65f49a6a79f29cd0201992f48e
-
SHA256
3ed0a47a3b401acbde6083ff9068d52907ea1b9e8656436cf3bdf967993e3883
-
SHA512
c1d50bb7d22a365e43387f1d22d5f483c4f2c3bcd0e37b1c561cff1de25503ae7340952feabf52f69fe36e7c4bf8b4847ff9e110217dd5131be68274af63579a
-
SSDEEP
768:Cecbl/b37gMYAoReJ2uBFE9RnlOqhGbq:pcxBJ24FE9RnlOq4O
Malware Config
Extracted
Family
xworm
Version
3.1
C2
22.ip.gl.ply.gg:9620
Mutex
m6SfcQlFEq1KFNwn
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral2/memory/3660-1-0x00000000008C0000-0x00000000008CE000-memory.dmp family_xworm -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3660 XClient.exe