Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
27s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19/08/2024, 12:10
General
-
Target
XClient.exe
-
Size
30KB
-
MD5
20648ba8bb78f73742b3053ad59d3a4c
-
SHA1
ff09b9288194ad65f49a6a79f29cd0201992f48e
-
SHA256
3ed0a47a3b401acbde6083ff9068d52907ea1b9e8656436cf3bdf967993e3883
-
SHA512
c1d50bb7d22a365e43387f1d22d5f483c4f2c3bcd0e37b1c561cff1de25503ae7340952feabf52f69fe36e7c4bf8b4847ff9e110217dd5131be68274af63579a
-
SSDEEP
768:Cecbl/b37gMYAoReJ2uBFE9RnlOqhGbq:pcxBJ24FE9RnlOq4O
Score
10/10
Malware Config
Extracted
Family
xworm
Version
3.1
C2
22.ip.gl.ply.gg:9620
Mutex
m6SfcQlFEq1KFNwn
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB