Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/11/2024, 12:55

General

  • Target

    4c8c129addb0befc1233bcf97b5f2ba5aa768cc529d3244c7fd452b9a599ed27.exe

  • Size

    10.3MB

  • MD5

    086ae059efcfa3719a91eb362ea7b0d3

  • SHA1

    60701d200851fd9ebfdd8839683c0bc0dcd01050

  • SHA256

    4c8c129addb0befc1233bcf97b5f2ba5aa768cc529d3244c7fd452b9a599ed27

  • SHA512

    8cd3cbadef4b14ddf322bc718b1a9956ce3211fcd0765ba8ef2af4ca4465cdb7baa7afdaf9e47da13d1098c5e2d0118dad7b5b85c27fcc2d5e1070f50818cb3b

  • SSDEEP

    196608:56nteHdgyFauFurL9pQQ9elLB9bRjc+TTAO8lw7NXCm9:ieHmENUelLTR5n8l+X9

Malware Config

Extracted

Family

xworm

Version

5.0

C2

147.124.219.98:7000

Mutex

MRb1Mp9n6eyda5j3

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4c8c129addb0befc1233bcf97b5f2ba5aa768cc529d3244c7fd452b9a599ed27.exe
    "C:\Users\Admin\AppData\Local\Temp\4c8c129addb0befc1233bcf97b5f2ba5aa768cc529d3244c7fd452b9a599ed27.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2116
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
      2⤵
      • Drops startup file
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:3060

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2116-18-0x00000000005AE000-0x00000000005C6000-memory.dmp

    Filesize

    96KB

  • memory/2116-12-0x0000000000E08000-0x0000000000E14000-memory.dmp

    Filesize

    48KB

  • memory/2116-3-0x0000000000400000-0x0000000000E82000-memory.dmp

    Filesize

    10.5MB

  • memory/2116-2-0x0000000000400000-0x0000000000E82000-memory.dmp

    Filesize

    10.5MB

  • memory/2116-5-0x0000000000400000-0x0000000000E82000-memory.dmp

    Filesize

    10.5MB

  • memory/2116-1-0x00000000005AE000-0x00000000005C6000-memory.dmp

    Filesize

    96KB

  • memory/2116-7-0x0000000000400000-0x0000000000E82000-memory.dmp

    Filesize

    10.5MB

  • memory/2116-9-0x0000000000400000-0x0000000000E82000-memory.dmp

    Filesize

    10.5MB

  • memory/2116-0-0x0000000000400000-0x0000000000E82000-memory.dmp

    Filesize

    10.5MB

  • memory/3060-6-0x0000000000F10000-0x0000000000F1E000-memory.dmp

    Filesize

    56KB

  • memory/3060-10-0x0000000005B10000-0x0000000005BAC000-memory.dmp

    Filesize

    624KB

  • memory/3060-17-0x0000000005D30000-0x0000000005D40000-memory.dmp

    Filesize

    64KB

  • memory/3060-11-0x00000000745FE000-0x00000000745FF000-memory.dmp

    Filesize

    4KB

  • memory/3060-19-0x0000000006540000-0x00000000065A6000-memory.dmp

    Filesize

    408KB

  • memory/3060-20-0x00000000745FE000-0x00000000745FF000-memory.dmp

    Filesize

    4KB

  • memory/3060-21-0x0000000007540000-0x00000000075D2000-memory.dmp

    Filesize

    584KB

  • memory/3060-22-0x0000000007B90000-0x0000000008134000-memory.dmp

    Filesize

    5.6MB