Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    XClient.exe

  • Size

    58KB

  • Sample

    241117-fdam4s1hjf

  • MD5

    0b664dbbbb3530b7f6bef9b1d61addb9

  • SHA1

    9f5d5bd42ec1c44db3274396754db0c46ac169a5

  • SHA256

    48d74602d8e488f13359a7c54e4ff30e3e48d44190e57153539207b57a0f3ea4

  • SHA512

    6adff37cac5cc056f17c63b7cfefe6d7d4ab1da19ca3c5b59cbf22ead471e3c7416ff2b70eaf8be81af77dffabbd521aa563296eef6297e1e71bcbb42f9293cf

  • SSDEEP

    1536:NELc8UB3jYNK6stQKEHSWcagrR4Zb/sordrmt69O0b0BQ5O:mLvUtYVTKEHSWcNR4Zb/JdO0b0BIO

Malware Config

Extracted

Family

xworm

Version

3.1

C2

147.185.221.22:4999

Attributes
  • Install_directory

    %Public%

  • install_file

    USB.exe

Targets

    • Target

      XClient.exe

    • Size

      58KB

    • MD5

      0b664dbbbb3530b7f6bef9b1d61addb9

    • SHA1

      9f5d5bd42ec1c44db3274396754db0c46ac169a5

    • SHA256

      48d74602d8e488f13359a7c54e4ff30e3e48d44190e57153539207b57a0f3ea4

    • SHA512

      6adff37cac5cc056f17c63b7cfefe6d7d4ab1da19ca3c5b59cbf22ead471e3c7416ff2b70eaf8be81af77dffabbd521aa563296eef6297e1e71bcbb42f9293cf

    • SSDEEP

      1536:NELc8UB3jYNK6stQKEHSWcagrR4Zb/sordrmt69O0b0BQ5O:mLvUtYVTKEHSWcNR4Zb/JdO0b0BIO

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Xworm family

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks