Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

1730880366...ed.exe

windows7-x64

10

1730880366...ed.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/11/2024, 08:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    173088036612e8960cb0e3e660a4c615e4ea5d03f8856803d40b8b98bfa265df8cb5cd3077867.dat-decoded.exe

  • Size

    40KB

  • MD5

    615786070805c9eb0ca58cf09682e9b0

  • SHA1

    319b760d1015ee62f8dda6c673f7deed18c9f414

  • SHA256

    f99ae2843d9c3ffa02e211777e7cfa2a9c759139ec922d062c5883679e8b3823

  • SHA512

    bdda9588b7c759ccd197728061e48e2a91b30ffee11309d3acdcfb931f73fef5a4652625570158dde5134fae420cdb84d174d0cfe8b4f366eb7e91075a5ddf11

  • SSDEEP

    384:nFLDb8mACT+aFifsEmn4w1+Qk7zuPgg8Kx493yBtrLaWGPjxLCPOnsSZwHV6cWRn:ZDb0I+a4DL7zg2Kd3yG92RlF

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

C2

xworm1120.duckdns.org:1120

Mutex

D0iCsL6PUuq7iVxc

Attributes
  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm

Processes

  • C:\Users\Admin\AppData\Local\Temp\173088036612e8960cb0e3e660a4c615e4ea5d03f8856803d40b8b98bfa265df8cb5cd3077867.dat-decoded.exe
    "C:\Users\Admin\AppData\Local\Temp\173088036612e8960cb0e3e660a4c615e4ea5d03f8856803d40b8b98bfa265df8cb5cd3077867.dat-decoded.exe"
    1⤵
      PID:3316

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3316-0-0x00007FFCC8283000-0x00007FFCC8285000-memory.dmp

      Filesize

      8KB

      Download

    • memory/3316-1-0x00000000007E0000-0x00000000007F0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3316-2-0x00007FFCC8280000-0x00007FFCC8D41000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3316-3-0x00007FFCC8280000-0x00007FFCC8D41000-memory.dmp

      Filesize

      10.8MB

      Download