Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

hitboxyfivem2024.exe

windows7-x64

10

hitboxyfivem2024.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    9s
  • max time network
    6s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    13/10/2024, 00:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    hitboxyfivem2024.exe

  • Size

    35.2MB

  • MD5

    5abc8be3cb3ad48aebf2a63f05341582

  • SHA1

    47e3f6e271fa04748ee1b83afc7d0a21059f9ae5

  • SHA256

    5c8608607a328036d0c4ddde044703033a6b105f62e167fb9abd6739036215c8

  • SHA512

    c8beeba10268f76fb1bfa7036a3094335eb383bcf81010decc5ad2b1fd99075ad57a44196e544fd2e9e83663dab3fc6f121c15eaecf4f5af8c285397e63bee14

  • SSDEEP

    786432:6A6Vk51XxQgLespvvwY0vFfVtMI9aznj381fvKFf+/CfBGkZOHk+:eV6Kfsp50BzMSazrcfvKh+/CpGsS

Score
10/10
xwormpyinstallerrattrojan

Malware Config

Extracted

Family

xworm

C2

147.185.221.21:27469

Attributes
  • Install_directory

    %AppData%

  • install_file

    astroGG.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Detects Pyinstaller 3 IoCs
    pyinstaller

Processes

  • C:\Users\Admin\AppData\Local\Temp\hitboxyfivem2024.exe
    "C:\Users\Admin\AppData\Local\Temp\hitboxyfivem2024.exe"
    1⤵
      PID:2772
      • C:\Users\Admin\AppData\Local\Temp\AstroBootStrapper.exe
        "C:\Users\Admin\AppData\Local\Temp\AstroBootStrapper.exe"
        2⤵
          PID:2228
        • C:\Users\Admin\AppData\Local\Temp\astroGG.exe
          "C:\Users\Admin\AppData\Local\Temp\astroGG.exe"
          2⤵
            PID:2900

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\AstroBootStrapper.exe
          Filesize

          8.8MB

          MD5

          34c205b4f63a48a7257f9e73f13460f0

          SHA1

          fc6377043a0efc25a591d2a45737b0b2497c94d5

          SHA256

          cb770035a8fead527dd6aa00e89600c55581209a01518c0385d8c5524af44b1f

          SHA512

          65899c2327267ed8d08fb7181188eae1a9dc91bf875642fca1c02d6e3bf156182e65aa4eefbba34536cec5f094db5bb26ea9807a8376fd8b443789db33068e87

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\AstroBootStrapper.exe
          Filesize

          8.4MB

          MD5

          658dc13c3d19d4262a807d0cf9fd8efa

          SHA1

          4493594992c88eb9d7e5095108d75bf13d3e6df8

          SHA256

          7de2f856cae456e440d2bc7ad02e37c05c3793f30740942aefee062eb11e43fe

          SHA512

          dc3c5e494c084d2658753d3fa9c468308a7750aef86f0210ce040ef6a73d8d8da66f1a445452b94e177c57fb1bfb9318c8fccf6d7703fb1c0efbf78418ca5d48

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\astroGG.exe
          Filesize

          60KB

          MD5

          aa214096148443fef487b52dbecee5a4

          SHA1

          ebd815c0faa3cb17f4a6c6c41ef1faaa307c68c8

          SHA256

          05171a217f14814ed567a59e4230ebcb2a552720e8419761016b2ba8677f9a2a

          SHA512

          ae0a44736c385da5119f27190af09e18ce7c2c26ae81fd3b194683cd27da6ea839206348578c4e5ec0cfd428ef89d0c2e318d711a2915fae3df7ab407b74cc0e

          Download Submit

        • \Users\Admin\AppData\Local\Temp\AstroBootStrapper.exe
          Filesize

          8.6MB

          MD5

          938b9c6d40e3c3de7c3ac90c39891ac0

          SHA1

          eb870176f9252e50ae4f2d64bcef4bc4f65b054a

          SHA256

          5950250ef5965ebc1af19d32d29065edb54841d75bd99e3eab901996b3c0ef49

          SHA512

          1651e24f111196698cc62bf9f7a39fe67367510577922d074ae9b503a865d608b7a14da7045e2b84dd0c55d10636fc0fe20a818d84ecf05c7ff0f00924275c26

          Download Submit

        • memory/2772-0-0x000007FEF6383000-0x000007FEF6384000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2772-1-0x0000000000020000-0x0000000002360000-memory.dmp

          Filesize

          35.2MB

          Download

        • memory/2772-2-0x000007FEF6380000-0x000007FEF6D6C000-memory.dmp

          Filesize

          9.9MB

          Download

        • memory/2772-21-0x000007FEF6380000-0x000007FEF6D6C000-memory.dmp

          Filesize

          9.9MB

          Download

        • memory/2900-16-0x00000000000B0000-0x00000000000C6000-memory.dmp

          Filesize

          88KB

          Download

        • memory/2900-18-0x000007FEF6380000-0x000007FEF6D6C000-memory.dmp

          Filesize

          9.9MB

          Download