Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

4577be03ef...fN.exe

windows7-x64

10

4577be03ef...fN.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    21/01/2025, 12:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4577be03ef032e67ab43238e959ed685d6bd1df465ef6a49d081a12ca732e55fN.exe

  • Size

    32KB

  • MD5

    66bc605adfe5a9a746dd0a9953555bc0

  • SHA1

    1351363e9ed3ce25f4d36a82fb606fe5b3a14c5e

  • SHA256

    4577be03ef032e67ab43238e959ed685d6bd1df465ef6a49d081a12ca732e55f

  • SHA512

    6bc1052dd637d9e1f1b8541dbfd44fe5b396330dca27ad24c032c4d867278ace02a99347b870108a8a59d95261b53ed4f2fbf272d2aeddd4baced591b8ad4f2d

  • SSDEEP

    384:bEbmX5Qa+vN1h1+X3v6JFjL+g93Tm2eaFO4FzRApkFTBLTsOZwpGd2v99Ikuisq8:oVa+vNtg+PB93Tw49FzVFE9jTOjhOb4

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:7000

Mutex

i709h2VhFlRsldOu

Attributes
  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4577be03ef032e67ab43238e959ed685d6bd1df465ef6a49d081a12ca732e55fN.exe
    "C:\Users\Admin\AppData\Local\Temp\4577be03ef032e67ab43238e959ed685d6bd1df465ef6a49d081a12ca732e55fN.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1056-0-0x000007FEF4F13000-0x000007FEF4F14000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1056-1-0x0000000001290000-0x000000000129E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1056-2-0x000007FEF4F10000-0x000007FEF58FC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1056-3-0x000007FEF4F13000-0x000007FEF4F14000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1056-4-0x000007FEF4F10000-0x000007FEF58FC000-memory.dmp

    Filesize

    9.9MB

    Download