Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    296s
  • max time network
    296s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/01/2025, 20:38 UTC

General

  • Target

    XClient.exe

  • Size

    64KB

  • MD5

    0b825a60d5232c19548fe6bee6eceaf7

  • SHA1

    70b29e65c74ee6d11dd99ab644ea967efd868aa2

  • SHA256

    ad13779dfed42b4f1fc882216a9157bc65aee15f058b784ea809b86fceae34af

  • SHA512

    408f6f6239a4a11913f012d7a6ba8d7c48896312a894d574b892553aeb6658ad1f4599d1cc899beb2e762c6496654077dfbe253e0f4a53d63a5dd1327f1d570a

  • SSDEEP

    1536:ElDBb5dZjeQ+3uYkkf9pWbkoxy061cOirS0LpHn2TfaS:Ell5/7+3uYkkXWbk+jOirS0dHEaS

Malware Config

Extracted

Family

xworm

C2

memory-lottery.gl.at.ply.gg:444

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:972
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3944
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4448
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\security'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3420
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'security'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:736
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "security" /tr "C:\Users\Admin\AppData\Roaming\security"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4076
  • C:\Users\Admin\AppData\Roaming\security
    C:\Users\Admin\AppData\Roaming\security
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3080
  • C:\Users\Admin\AppData\Roaming\security
    C:\Users\Admin\AppData\Roaming\security
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2388
  • C:\Users\Admin\AppData\Roaming\security
    C:\Users\Admin\AppData\Roaming\security
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1356
  • C:\Users\Admin\AppData\Roaming\security
    C:\Users\Admin\AppData\Roaming\security
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4292
  • C:\Users\Admin\AppData\Roaming\security
    C:\Users\Admin\AppData\Roaming\security
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3172

Network

  • flag-us
    DNS
    13.86.106.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.86.106.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    133.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    167.173.78.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    167.173.78.104.in-addr.arpa
    IN PTR
    Response
    167.173.78.104.in-addr.arpa
    IN PTR
    a104-78-173-167deploystaticakamaitechnologiescom
  • flag-us
    DNS
    167.173.78.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    167.173.78.104.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    memory-lottery.gl.at.ply.gg
    XClient.exe
    Remote address:
    8.8.8.8:53
    Request
    memory-lottery.gl.at.ply.gg
    IN A
    Response
    memory-lottery.gl.at.ply.gg
    IN A
    147.185.221.25
  • flag-us
    DNS
    228.249.119.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    228.249.119.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    56.163.245.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    56.163.245.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    22.49.80.91.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    22.49.80.91.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    88.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.210.23.2.in-addr.arpa
    IN PTR
    Response
    88.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-88deploystaticakamaitechnologiescom
  • flag-us
    DNS
    14.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.227.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    memory-lottery.gl.at.ply.gg
    XClient.exe
    Remote address:
    8.8.8.8:53
    Request
    memory-lottery.gl.at.ply.gg
    IN A
    Response
    memory-lottery.gl.at.ply.gg
    IN A
    147.185.221.25
  • 147.185.221.25:444
    memory-lottery.gl.at.ply.gg
    XClient.exe
    260 B
    5
  • 147.185.221.25:444
    memory-lottery.gl.at.ply.gg
    XClient.exe
    260 B
    5
  • 147.185.221.25:444
    memory-lottery.gl.at.ply.gg
    XClient.exe
    260 B
    5
  • 147.185.221.25:444
    memory-lottery.gl.at.ply.gg
    XClient.exe
    260 B
    5
  • 147.185.221.25:444
    memory-lottery.gl.at.ply.gg
    XClient.exe
    260 B
    5
  • 147.185.221.25:444
    memory-lottery.gl.at.ply.gg
    XClient.exe
    260 B
    5
  • 147.185.221.25:444
    memory-lottery.gl.at.ply.gg
    XClient.exe
    260 B
    5
  • 147.185.221.25:444
    memory-lottery.gl.at.ply.gg
    XClient.exe
    260 B
    5
  • 147.185.221.25:444
    memory-lottery.gl.at.ply.gg
    XClient.exe
    260 B
    5
  • 147.185.221.25:444
    memory-lottery.gl.at.ply.gg
    XClient.exe
    260 B
    5
  • 147.185.221.25:444
    memory-lottery.gl.at.ply.gg
    XClient.exe
    208 B
    4
  • 8.8.8.8:53
    13.86.106.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    13.86.106.20.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    133.32.126.40.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    133.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    167.173.78.104.in-addr.arpa
    dns
    146 B
    139 B
    2
    1

    DNS Request

    167.173.78.104.in-addr.arpa

    DNS Request

    167.173.78.104.in-addr.arpa

  • 8.8.8.8:53
    memory-lottery.gl.at.ply.gg
    dns
    XClient.exe
    73 B
    89 B
    1
    1

    DNS Request

    memory-lottery.gl.at.ply.gg

    DNS Response

    147.185.221.25

  • 8.8.8.8:53
    228.249.119.40.in-addr.arpa
    dns
    73 B
    159 B
    1
    1

    DNS Request

    228.249.119.40.in-addr.arpa

  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    56.163.245.4.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    56.163.245.4.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

  • 8.8.8.8:53
    22.49.80.91.in-addr.arpa
    dns
    70 B
    145 B
    1
    1

    DNS Request

    22.49.80.91.in-addr.arpa

  • 8.8.8.8:53
    88.210.23.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    88.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    14.227.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    14.227.111.52.in-addr.arpa

  • 8.8.8.8:53
    memory-lottery.gl.at.ply.gg
    dns
    XClient.exe
    73 B
    89 B
    1
    1

    DNS Request

    memory-lottery.gl.at.ply.gg

    DNS Response

    147.185.221.25

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    d85ba6ff808d9e5444a4b369f5bc2730

    SHA1

    31aa9d96590fff6981b315e0b391b575e4c0804a

    SHA256

    84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

    SHA512

    8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\security.log

    Filesize

    654B

    MD5

    2ff39f6c7249774be85fd60a8f9a245e

    SHA1

    684ff36b31aedc1e587c8496c02722c6698c1c4e

    SHA256

    e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

    SHA512

    1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    d28a889fd956d5cb3accfbaf1143eb6f

    SHA1

    157ba54b365341f8ff06707d996b3635da8446f7

    SHA256

    21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

    SHA512

    0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    2d06ce10e4e5b9e174b5ebbdad300fad

    SHA1

    bcc1c231e22238cef02ae25331320060ada2f131

    SHA256

    87d1dd56f12a88907ba5aebca8d555443d6f77ed214497277cc8bcd31c669f2c

    SHA512

    38cfbeb59605854ae4fcfae8619a6b26bd916148acfb5636383672a3960b45ca41fed5c241f97465129e92eaf78c4c85dcf258f1ab501a2bf771287ce04f76a7

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    10890cda4b6eab618e926c4118ab0647

    SHA1

    1e1d63b73a0e6c7575f458b3c7917a9ce5ba776d

    SHA256

    00f8a035324d39bd62e6dee5e1b480069015471c487ebee4479e6990ea9ddb14

    SHA512

    a2ee84006c24a36f25e0bca0772430d64e3791f233da916aecdeae6712763e77d55bbbd00dc8f6b2b3887f3c26ab3980b96c5f46cc823e81e28abbbc5fc78221

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_swu5ok5l.3pp.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Roaming\security

    Filesize

    64KB

    MD5

    0b825a60d5232c19548fe6bee6eceaf7

    SHA1

    70b29e65c74ee6d11dd99ab644ea967efd868aa2

    SHA256

    ad13779dfed42b4f1fc882216a9157bc65aee15f058b784ea809b86fceae34af

    SHA512

    408f6f6239a4a11913f012d7a6ba8d7c48896312a894d574b892553aeb6658ad1f4599d1cc899beb2e762c6496654077dfbe253e0f4a53d63a5dd1327f1d570a

  • memory/972-1-0x0000000000910000-0x0000000000926000-memory.dmp

    Filesize

    88KB

  • memory/972-0-0x00007FFCA5843000-0x00007FFCA5845000-memory.dmp

    Filesize

    8KB

  • memory/972-58-0x00007FFCA5840000-0x00007FFCA6301000-memory.dmp

    Filesize

    10.8MB

  • memory/972-57-0x00007FFCA5840000-0x00007FFCA6301000-memory.dmp

    Filesize

    10.8MB

  • memory/972-56-0x00007FFCA5843000-0x00007FFCA5845000-memory.dmp

    Filesize

    8KB

  • memory/3944-12-0x00007FFCA5840000-0x00007FFCA6301000-memory.dmp

    Filesize

    10.8MB

  • memory/3944-18-0x00007FFCA5840000-0x00007FFCA6301000-memory.dmp

    Filesize

    10.8MB

  • memory/3944-15-0x00007FFCA5840000-0x00007FFCA6301000-memory.dmp

    Filesize

    10.8MB

  • memory/3944-14-0x00007FFCA5840000-0x00007FFCA6301000-memory.dmp

    Filesize

    10.8MB

  • memory/3944-13-0x00007FFCA5840000-0x00007FFCA6301000-memory.dmp

    Filesize

    10.8MB

  • memory/3944-2-0x000002ACAA170000-0x000002ACAA192000-memory.dmp

    Filesize

    136KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.