Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

XClient.exe

windows7-x64

10

XClient.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    36s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20/01/2025, 19:21 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    XClient.exe

  • Size

    42KB

  • MD5

    3982031e2e82143cf90b273b6b614231

  • SHA1

    5a212b3d718c26cb34fc043b19979bfd37b07934

  • SHA256

    08a0be6e3717d3ac5e6117536f42dbc4e08ff41958eb059038f648c447146198

  • SHA512

    e3eee612bea1d8277136a849494cd9e1767df8b77557349e7b35d8fc3dea82031e19f5d4da767fa7589e4623b6a46671b98b7110c7f802a5ac4f5a24b036ae5a

  • SSDEEP

    768:x/CsBpA2DYSPdTls3AyZrl2F59g/OCh80R8lEZ:x/C2dD0wF59g/OCu1EZ

Score
10/10
xwormpersistencerattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

https://pastebin.com/raw/cyX7R6Kt:1

Mutex

H52DR5xUvBhWUz6h

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    msconfig.exe

  • pastebin_url

    https://pastebin.com/raw/cyX7R6Kt

aes.plain
1
CF29vHt3M7j3CELCyHNRFA==

Signatures

  • Detect Xworm Payload 3 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2708
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "msconfig" /tr "C:\Users\Admin\msconfig.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2832
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {3ECED557-4AB0-4468-9C16-3A825A8877C9} S-1-5-21-312935884-697965778-3955649944-1000:MXQFNXLT\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2820
    • C:\Users\Admin\msconfig.exe
      C:\Users\Admin\msconfig.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2768

Network

  • flag-us
    DNS
    pastebin.com
    XClient.exe
    Remote address:
    8.8.8.8:53
    Request
    pastebin.com
    IN A
    Response
    pastebin.com
    IN A
    104.20.3.235
    pastebin.com
    IN A
    104.20.4.235
    pastebin.com
    IN A
    172.67.19.24
  • flag-us
    GET
    https://pastebin.com/raw/cyX7R6Kt
    XClient.exe
    Remote address:
    104.20.3.235:443
    Request
    GET /raw/cyX7R6Kt HTTP/1.1
    Host: pastebin.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 403 Forbidden
    Date: Mon, 20 Jan 2025 19:22:01 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 6752
    Connection: close
    accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
    critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
    cross-origin-embedder-policy: require-corp
    cross-origin-opener-policy: same-origin
    cross-origin-resource-policy: same-origin
    origin-agent-cluster: ?1
    permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
    referrer-policy: same-origin
    x-content-options: nosniff
    x-frame-options: SAMEORIGIN
    cf-mitigated: challenge
    cf-chl-out: 1DKA4hdfRJjEHHAfSGd4KuCroWY+R+owQU0zIkJr4yuwQdPLzHIglmanaYaNdmw8Kp0a5qnlfV0Mq5le+L8f7HkwK/dJNT1/s/+eNyJQRgg=$omXmixjjqsqwUGDl4KqVhw==
    Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
    Expires: Thu, 01 Jan 1970 00:00:01 GMT
    Server: cloudflare
    CF-RAY: 90516e4e7efb63f2-LHR
  • flag-us
    GET
    https://pastebin.com/raw/cyX7R6Kt
    XClient.exe
    Remote address:
    104.20.3.235:443
    Request
    GET /raw/cyX7R6Kt HTTP/1.1
    Host: pastebin.com
    Response
    HTTP/1.1 403 Forbidden
    Date: Mon, 20 Jan 2025 19:22:04 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 6816
    Connection: close
    accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
    critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
    cross-origin-embedder-policy: require-corp
    cross-origin-opener-policy: same-origin
    cross-origin-resource-policy: same-origin
    origin-agent-cluster: ?1
    permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
    referrer-policy: same-origin
    x-content-options: nosniff
    x-frame-options: SAMEORIGIN
    cf-mitigated: challenge
    cf-chl-out: R2wQn2xYx+ui6Yq7IvKOyOJpUmJUvZvM+ILlAiSiVEyVUvsqRQux6ucUFsaysgecSAbzZ0Kj8B3/F3asT2MT0LIGcnvKINA3Bcf3aSvzHXA=$oodlih/a5bcLf2k6U0cYaw==
    Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
    Expires: Thu, 01 Jan 1970 00:00:01 GMT
    Server: cloudflare
    CF-RAY: 90516e624a5263f6-LHR
  • flag-us
    GET
    https://pastebin.com/raw/cyX7R6Kt
    XClient.exe
    Remote address:
    104.20.3.235:443
    Request
    GET /raw/cyX7R6Kt HTTP/1.1
    Host: pastebin.com
    Response
    HTTP/1.1 403 Forbidden
    Date: Mon, 20 Jan 2025 19:22:07 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 6795
    Connection: close
    accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
    critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
    cross-origin-embedder-policy: require-corp
    cross-origin-opener-policy: same-origin
    cross-origin-resource-policy: same-origin
    origin-agent-cluster: ?1
    permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
    referrer-policy: same-origin
    x-content-options: nosniff
    x-frame-options: SAMEORIGIN
    cf-mitigated: challenge
    cf-chl-out: d5q4nPHFE6SIuwpisNGESP6fOh3auL2TENGa+VVtZAi+/Wnc+81TzDULwj6iQx8v1UKxtcoH6zSFJjudiGvOpkmowOKZCfALRy3a9QFR5yo=$BFXPBvlcWNyHSd492LvnUg==
    Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
    Expires: Thu, 01 Jan 1970 00:00:01 GMT
    Server: cloudflare
    CF-RAY: 90516e767b2593db-LHR
  • flag-us
    GET
    https://pastebin.com/raw/cyX7R6Kt
    XClient.exe
    Remote address:
    104.20.3.235:443
    Request
    GET /raw/cyX7R6Kt HTTP/1.1
    Host: pastebin.com
    Response
    HTTP/1.1 403 Forbidden
    Date: Mon, 20 Jan 2025 19:22:14 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 6816
    Connection: close
    accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
    critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
    cross-origin-embedder-policy: require-corp
    cross-origin-opener-policy: same-origin
    cross-origin-resource-policy: same-origin
    origin-agent-cluster: ?1
    permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
    referrer-policy: same-origin
    x-content-options: nosniff
    x-frame-options: SAMEORIGIN
    cf-mitigated: challenge
    cf-chl-out: kC8lX3jhhh5kr9I0Mn5SAn/05wagb26jRnNsCtui30t2+H/cwA7CQSI4HF2Cd9Rxs20j5llrlGtEjlNwNtcinRG+oai+IhXofXT+AdB6buA=$C8Xx5Kt3QvZmLNp0SeCYZA==
    Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
    Expires: Thu, 01 Jan 1970 00:00:01 GMT
    Server: cloudflare
    CF-RAY: 90516e9d6b8893e5-LHR
  • flag-us
    GET
    https://pastebin.com/raw/cyX7R6Kt
    XClient.exe
    Remote address:
    104.20.3.235:443
    Request
    GET /raw/cyX7R6Kt HTTP/1.1
    Host: pastebin.com
    Response
    HTTP/1.1 403 Forbidden
    Date: Mon, 20 Jan 2025 19:22:20 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 6795
    Connection: close
    accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
    critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
    cross-origin-embedder-policy: require-corp
    cross-origin-opener-policy: same-origin
    cross-origin-resource-policy: same-origin
    origin-agent-cluster: ?1
    permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
    referrer-policy: same-origin
    x-content-options: nosniff
    x-frame-options: SAMEORIGIN
    cf-mitigated: challenge
    cf-chl-out: 80YRUdUFZFw6bU+cnHBRt9ZyW3ACrI2l4jRzOAa0ZOvjJvbu6CODgGKkugRNXvdfTKK63dGRB68ukTyoGJOwSzDIuuRXdLoAgrOy+Uz79S0=$/Z5oU8w99AETjp20u3lofg==
    Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
    Expires: Thu, 01 Jan 1970 00:00:01 GMT
    Server: cloudflare
    CF-RAY: 90516ec7be9bbead-LHR
  • flag-us
    GET
    https://pastebin.com/raw/cyX7R6Kt
    XClient.exe
    Remote address:
    104.20.3.235:443
    Request
    GET /raw/cyX7R6Kt HTTP/1.1
    Host: pastebin.com
    Response
    HTTP/1.1 403 Forbidden
    Date: Mon, 20 Jan 2025 19:22:23 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 6816
    Connection: close
    accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
    critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
    cross-origin-embedder-policy: require-corp
    cross-origin-opener-policy: same-origin
    cross-origin-resource-policy: same-origin
    origin-agent-cluster: ?1
    permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
    referrer-policy: same-origin
    x-content-options: nosniff
    x-frame-options: SAMEORIGIN
    cf-mitigated: challenge
    cf-chl-out: vcHgCaljYO33PF20aupU1O14W0xb7G4COm5BK8AClqcVow6WEtjm1bTwC57CW4y7cNzHE/LyZm+jkV4sDB4yNFVcbvub0qIyKAGTS8ovMno=$/T6vxcT3jyUlsY5yGEc4aQ==
    Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
    Expires: Thu, 01 Jan 1970 00:00:01 GMT
    Server: cloudflare
    CF-RAY: 90516edb9eb6be95-LHR
  • flag-us
    GET
    https://pastebin.com/raw/cyX7R6Kt
    XClient.exe
    Remote address:
    104.20.3.235:443
    Request
    GET /raw/cyX7R6Kt HTTP/1.1
    Host: pastebin.com
    Response
    HTTP/1.1 403 Forbidden
    Date: Mon, 20 Jan 2025 19:22:27 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 6816
    Connection: close
    accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
    critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
    cross-origin-embedder-policy: require-corp
    cross-origin-opener-policy: same-origin
    cross-origin-resource-policy: same-origin
    origin-agent-cluster: ?1
    permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
    referrer-policy: same-origin
    x-content-options: nosniff
    x-frame-options: SAMEORIGIN
    cf-mitigated: challenge
    cf-chl-out: qYchFBtqawsjrlzqPdQMfn9brbwD5nR5wKDDU7jLaMeBjarFhB/Gun0BuLLjNjxDno52lrIj9eSb3RnGwFRUbUnvdSxWGReRIYosxFX+cxc=$/ma6JFZ5geEQaZ/LEQVK7g==
    Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
    Expires: Thu, 01 Jan 1970 00:00:01 GMT
    Server: cloudflare
    CF-RAY: 90516eef5f31bebc-LHR
  • 104.20.3.235:443
    https://pastebin.com/raw/cyX7R6Kt
    tls, http
    XClient.exe
    969 B
     12.1kB
     13
    17

    HTTP Request

    GET https://pastebin.com/raw/cyX7R6Kt

    HTTP Response

    403
  • 104.20.3.235:443
    https://pastebin.com/raw/cyX7R6Kt
    tls, http
    XClient.exe
    816 B
     9.4kB
     11
    14

    HTTP Request

    GET https://pastebin.com/raw/cyX7R6Kt

    HTTP Response

    403
  • 104.20.3.235:443
    https://pastebin.com/raw/cyX7R6Kt
    tls, http
    XClient.exe
    931 B
     12.1kB
     12
    16

    HTTP Request

    GET https://pastebin.com/raw/cyX7R6Kt

    HTTP Response

    403
  • 104.20.3.235:443
    https://pastebin.com/raw/cyX7R6Kt
    tls, http
    XClient.exe
    1.1kB
     9.5kB
     15
    15

    HTTP Request

    GET https://pastebin.com/raw/cyX7R6Kt

    HTTP Response

    403
  • 104.20.3.235:443
    https://pastebin.com/raw/cyX7R6Kt
    tls, http
    XClient.exe
    1.1kB
     12.3kB
     15
    19

    HTTP Request

    GET https://pastebin.com/raw/cyX7R6Kt

    HTTP Response

    403
  • 104.20.3.235:443
    https://pastebin.com/raw/cyX7R6Kt
    tls, http
    XClient.exe
    862 B
     9.4kB
     12
    15

    HTTP Request

    GET https://pastebin.com/raw/cyX7R6Kt

    HTTP Response

    403
  • 104.20.3.235:443
    https://pastebin.com/raw/cyX7R6Kt
    tls, http
    XClient.exe
    816 B
     9.4kB
     11
    15

    HTTP Request

    GET https://pastebin.com/raw/cyX7R6Kt

    HTTP Response

    403
  • 104.20.3.235:443
    XClient.exe
  • 8.8.8.8:53
    pastebin.com
    dns
    XClient.exe
    58 B
     106 B
     1
    1

    DNS Request

    pastebin.com

    DNS Response

    104.20.3.235
    104.20.4.235
    172.67.19.24

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\msconfig.exe
    Filesize

    42KB

    MD5

    3982031e2e82143cf90b273b6b614231

    SHA1

    5a212b3d718c26cb34fc043b19979bfd37b07934

    SHA256

    08a0be6e3717d3ac5e6117536f42dbc4e08ff41958eb059038f648c447146198

    SHA512

    e3eee612bea1d8277136a849494cd9e1767df8b77557349e7b35d8fc3dea82031e19f5d4da767fa7589e4623b6a46671b98b7110c7f802a5ac4f5a24b036ae5a

    Download Submit

  • memory/2708-0-0x000007FEF52E3000-0x000007FEF52E4000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2708-1-0x00000000000A0000-0x00000000000B0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2708-6-0x000007FEF52E0000-0x000007FEF5CCC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2708-11-0x000007FEF52E3000-0x000007FEF52E4000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2708-12-0x000007FEF52E0000-0x000007FEF5CCC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2768-10-0x0000000000CD0000-0x0000000000CE0000-memory.dmp

    Filesize

    64KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.