Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10XWorm/XWor...me.dll
windows7-x64
3XWorm/XWor...me.dll
windows10-2004-x64
1XWorm/XWor...ce.dll
windows7-x64
1XWorm/XWor...ce.dll
windows10-2004-x64
1XWorm/XWor...er.dll
windows7-x64
1XWorm/XWor...er.dll
windows10-2004-x64
1XWorm/XWor...ms.dll
windows7-x64
1XWorm/XWor...ms.dll
windows10-2004-x64
1XWorm/XWor...re.dll
windows7-x64
1XWorm/XWor...re.dll
windows10-2004-x64
1XWorm/XWor...ry.dll
windows7-x64
1XWorm/XWor...ry.dll
windows10-2004-x64
1XWorm/XWor...it.dll
windows7-x64
1XWorm/XWor...it.dll
windows10-2004-x64
1XWorm/XWor...op.dll
windows7-x64
1XWorm/XWor...op.dll
windows10-2004-x64
1XWorm/XWor...xy.dll
windows7-x64
1XWorm/XWor...xy.dll
windows10-2004-x64
1XWorm/XWor...PE.dll
windows7-x64
1XWorm/XWor...PE.dll
windows10-2004-x64
1XWorm/XWor...er.dll
windows7-x64
1XWorm/XWor...er.dll
windows10-2004-x64
1XWorm/XWor...ll.dll
windows7-x64
1XWorm/XWor...ll.dll
windows10-2004-x64
1XWorm/XWor...er.dll
windows7-x64
1XWorm/XWor...er.dll
windows10-2004-x64
1XWorm/XWor...er.dll
windows7-x64
1XWorm/XWor...er.dll
windows10-2004-x64
1XWorm/XWor...ns.dll
windows7-x64
1XWorm/XWor...ns.dll
windows10-2004-x64
1XWorm/XWor...ss.dll
windows7-x64
1XWorm/XWor...ss.dll
windows10-2004-x64
1Resubmissions
18/11/2024, 05:21 UTC
241118-f11stazdrk 10Analysis
-
max time kernel
92s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/11/2024, 05:21 UTC
Behavioral task
behavioral1
Sample
XWorm/XWorm V5.1/Plugins/Pastime.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
XWorm/XWorm V5.1/Plugins/Pastime.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
XWorm/XWorm V5.1/Plugins/Performance.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
XWorm/XWorm V5.1/Plugins/Performance.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
XWorm/XWorm V5.1/Plugins/ProcessManager.dll
Resource
win7-20241023-en
Behavioral task
behavioral6
Sample
XWorm/XWorm V5.1/Plugins/ProcessManager.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
XWorm/XWorm V5.1/Plugins/Programs.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
XWorm/XWorm V5.1/Plugins/Programs.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
XWorm/XWorm V5.1/Plugins/Ransomware.dll
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
XWorm/XWorm V5.1/Plugins/Ransomware.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
XWorm/XWorm V5.1/Plugins/Recovery.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
XWorm/XWorm V5.1/Plugins/Recovery.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
XWorm/XWorm V5.1/Plugins/Regedit.dll
Resource
win7-20241023-en
Behavioral task
behavioral14
Sample
XWorm/XWorm V5.1/Plugins/Regedit.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
XWorm/XWorm V5.1/Plugins/RemoteDesktop.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
XWorm/XWorm V5.1/Plugins/RemoteDesktop.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
XWorm/XWorm V5.1/Plugins/ReverseProxy.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
XWorm/XWorm V5.1/Plugins/ReverseProxy.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
XWorm/XWorm V5.1/Plugins/RunPE.dll
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
XWorm/XWorm V5.1/Plugins/RunPE.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
XWorm/XWorm V5.1/Plugins/ServiceManager.dll
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
XWorm/XWorm V5.1/Plugins/ServiceManager.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
XWorm/XWorm V5.1/Plugins/Shell.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
XWorm/XWorm V5.1/Plugins/Shell.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
XWorm/XWorm V5.1/Plugins/StartupManager.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
XWorm/XWorm V5.1/Plugins/StartupManager.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
XWorm/XWorm V5.1/Plugins/Stealer.dll
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
XWorm/XWorm V5.1/Plugins/Stealer.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
XWorm/XWorm V5.1/Plugins/TCPConnections.dll
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
XWorm/XWorm V5.1/Plugins/TCPConnections.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
XWorm/XWorm V5.1/Plugins/UACBypass.dll
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
XWorm/XWorm V5.1/Plugins/UACBypass.dll
Resource
win10v2004-20241007-en
General
-
Target
XWorm/XWorm V5.1/Plugins/Pastime.dll
-
Size
17KB
-
MD5
3ce2798e9b1eab7bb6bb1b3fd05b9d76
-
SHA1
158381fc7878eb05165f7366f19ff31fba430ce7
-
SHA256
875c1962bf11cf5f2028e0ef4f4bcc3daaf76580e238314bbf4e86cdffb6ada8
-
SHA512
00db6270b743f84522bf172737fb9a6ebe0572d190cfaba6e1d044846d6adc7c73db2b364aea97589d4928ca51186efe54a755a63fbe7b6825b9440b5cb1bacf
-
SSDEEP
384:CEoxsRLvyUi4U4R7XonhJAH+epi5zOY7//Zl/sA8/fT1:CEoKVvri4UA7YnEnwr/UA8/fh
Malware Config
Signatures
Processes
Network
-
Remote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request138.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request241.150.49.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request212.20.149.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request134.71.91.104.in-addr.arpaIN PTRResponse134.71.91.104.in-addr.arpaIN PTRa104-91-71-134deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request48.229.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
72 B 158 B 1 1
DNS Request
154.239.44.20.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
138.32.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
241.150.49.20.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
212.20.149.52.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
198.187.3.20.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
134.71.91.104.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
48.229.111.52.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa