Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
12s -
max time network
14s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
08/11/2024, 18:15
Static task
static1
General
-
Target
XClient.exe
-
Size
293KB
-
MD5
ee214d10a2af9c85607bd8505e48183f
-
SHA1
acf03f4f6a1a55db5e2df2683f628dc301006000
-
SHA256
2551f4ee4a0f5e2c91eb84dc75fbc00092cb7682d84c64e54f1a39ca075781f7
-
SHA512
d3abae4f437675a3d6b30a3d021075299546675e23f57905f35d4f2c3ddf05c8558518485b972fadbeb4aaab5cfaea13f432bdc15f69154fcb5ffb3f990f0767
-
SSDEEP
3072:TRNpkJuuEpKi6m/PJivSaAFOg7lkjcWVig058YbEASbod9bt+:T
Malware Config
Extracted
xworm
23.ip.gl.ply.gg:7000
-
Install_directory
%Public%
-
install_file
svchost.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/files/0x002600000004501f-9.dat family_xworm behavioral1/memory/1740-10-0x0000000000990000-0x00000000009A8000-memory.dmp family_xworm -
Xworm family
-
Executes dropped EXE 1 IoCs
pid Process 1740 .keepme -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 13 ip-api.com -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1740 .keepme -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 268 wrote to memory of 1112 268 XClient.exe 83 PID 268 wrote to memory of 1112 268 XClient.exe 83 PID 1112 wrote to memory of 1740 1112 cmd.exe 84 PID 1112 wrote to memory of 1740 1112 cmd.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\.shhh.bat" && exit2⤵
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\.keepme"C:\Users\Admin\AppData\Local\Temp\.keepme"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1740
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD55dcabac99e75c26966103e37d2d34fff
SHA1ee5ff56baaa7c854034a1952df3aebcb9051e2d9
SHA256889f0dbaf5641f17b2fff411473f75c62b551d11bedf4bb16b191f78f38a99e2
SHA512ec38e9bee65d3ad6ff31c1381a7e7b646544c44c3c944f387e02b7d1825cadf4fe0dfd7d914fa7872f8ba8b2862c0861eae91fce129ef30299afda639681f127
-
Filesize
57B
MD5cbade861cdb94418af59f05e2c2ba9d2
SHA1b52c1e9152f513e1c5bfd0a7120d8eab5715c6fa
SHA256690a862f8ba36d42573f9080aecd43eb6744b842cb382cee2bafdc493dae1ed4
SHA512fbdea30ef08dfde692d7d55e6b847a49448f095ac0dc7f4cb2aa87d1a965f681397db9ff5f25beb9ad48bf61578ccefdf7191de12ea9e8faba376bca0fd89d70