Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
144s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
03/11/2024, 23:44
Behavioral task
behavioral1
Sample
xclient.exe
Resource
win10ltsc2021-20241023-en
5 signatures
150 seconds
General
-
Target
xclient.exe
-
Size
45KB
-
MD5
e69ef8f0a3871d18e270fbcd5401dda1
-
SHA1
07efe1ecf83a2dc9a267734d2d514286e62355f2
-
SHA256
94b4cfcdf07caa2e8675caf46180753385cf32ef6a35101e157baf37a31265b5
-
SHA512
cc9e93cd46e102f20c51e37dd4a11c184b11683f78a2868c30adda26b94a86c922bb992373630e9117881d4e5656aeea364a7e6d502475832c954a9646f40bfd
-
SSDEEP
768:VurlDweV3OOVbADM9W1v9NfgkBpuAuREcNcFhlVvD4xeVhKfkgLbFEPa9pv9656M:VADweQKADMkV9GkSAcRaPlZrOD/FJ9NG
Malware Config
Extracted
Family
xworm
Version
5.0
C2
map-casio.gl.at.ply.gg:7777
Mutex
b32hkSTFWuq9ZKpj
Attributes
-
Install_directory
%Public%
-
install_file
XClient.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/2944-1-0x0000000000630000-0x0000000000642000-memory.dmp family_xworm -
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 15 ip-api.com -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2944 xclient.exe