Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1364s
  • max time network
    1143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/11/2024, 03:36

General

  • Target

    XClient.exe

  • Size

    41KB

  • MD5

    47ea7d50c48e3ba304f7cf9a0e8573d7

  • SHA1

    6c004062358f74d6223689f2481ba47123f41ae4

  • SHA256

    bbcc49815ed9e29f228efd8b9a2262594992e188f159f191a05a46fbab1c1c58

  • SHA512

    825d164e9727a787311dc191b9dfb4775834623b353d1a369565a601c5cdcb380beadad2ff73cd69e4b98f44ccebe0bdf293094f2758d7fd5de2b421ab9c485a

  • SSDEEP

    768:g+rJDweBDuOkScrbsN/x6WECAr43MxfJF5Pa9p+T6iOwhj3/ib3:g8DwewicrbsN/YDRrNRF49IT6iOwtar

Score
10/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

private-tomorrow.gl.at.ply.gg:15462

Mutex

4tLlKzGRhSDbkv4F

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4244-0-0x00007FFE84C83000-0x00007FFE84C85000-memory.dmp

    Filesize

    8KB

  • memory/4244-1-0x0000000000800000-0x0000000000810000-memory.dmp

    Filesize

    64KB

  • memory/4244-2-0x00007FFE84C80000-0x00007FFE85741000-memory.dmp

    Filesize

    10.8MB

  • memory/4244-3-0x00007FFE84C80000-0x00007FFE85741000-memory.dmp

    Filesize

    10.8MB