Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

XWorm_V5.6...rm.exe

windows7-x64

10

XWorm_V5.6...rm.exe

windows10-2004-x64

10

XWorm_V5.6...ox.dll

windows7-x64

1

XWorm_V5.6...ox.dll

windows10-2004-x64

1

XWorm_V5.6...er.bat

windows7-x64

1

XWorm_V5.6...er.bat

windows10-2004-x64

1

XWorm_V5.6...re.dll

windows7-x64

1

XWorm_V5.6...re.dll

windows10-2004-x64

1

XWorm_V5.6...ms.dll

windows7-x64

1

XWorm_V5.6...ms.dll

windows10-2004-x64

1

XWorm_V5.6...I2.dll

windows7-x64

1

XWorm_V5.6...I2.dll

windows10-2004-x64

1

XWorm_V5.6...or.dll

windows7-x64

1

XWorm_V5.6...or.dll

windows10-2004-x64

1

XWorm_V5.6...io.dll

windows7-x64

1

XWorm_V5.6...io.dll

windows10-2004-x64

1

XWorm_V5.6...on.dll

windows7-x64

1

XWorm_V5.6...on.dll

windows10-2004-x64

1

XWorm_V5.6...ws.dll

windows7-x64

1

XWorm_V5.6...ws.dll

windows10-2004-x64

1

XWorm_V5.6...at.dll

windows7-x64

1

XWorm_V5.6...at.dll

windows10-2004-x64

1

XWorm_V5.6...um.dll

windows7-x64

1

XWorm_V5.6...um.dll

windows10-2004-x64

1

XWorm_V5.6...rd.dll

windows7-x64

1

XWorm_V5.6...rd.dll

windows10-2004-x64

1

XWorm_V5.6...ss.dll

windows7-x64

1

XWorm_V5.6...ss.dll

windows10-2004-x64

1

XWorm_V5.6...er.dll

windows7-x64

1

XWorm_V5.6...er.dll

windows10-2004-x64

1

XWorm_V5.6...er.dll

windows7-x64

1

XWorm_V5.6...er.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/01/2025, 13:47 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    XWorm_V5.6/XWorm V5.6/FastColoredTextBox.dll

  • Size

    333KB

  • MD5

    b746707265772b362c0ba18d8d630061

  • SHA1

    4b185e5f68c00bef441adb737d0955646d4e569a

  • SHA256

    3701b19ccdac79b880b197756a972027e2ac609ebed36753bd989367ea4ef519

  • SHA512

    fd67f6c55940509e8060da53693cb5fbac574eb1e79d5bd8f9bbd43edbd05f68d5f73994798a0eed676d3e583e1c6cde608b54c03604b3818520fa18ad19aec8

  • SSDEEP

    6144:4FErOIif3RzSHh+20lXs1TzCeBcQeDbNlz7:eEeR52bmeh0n

Score
1/10

Malware Config

Signatures

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm_V5.6\XWorm V5.6\FastColoredTextBox.dll",#1
    1⤵
      PID:1212

    Network

    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
      Response
      8.8.8.8.in-addr.arpa
      IN PTR
      dnsgoogle
    • flag-us
      DNS
      58.55.71.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      58.55.71.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      79.190.18.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      79.190.18.2.in-addr.arpa
      IN PTR
      Response
      79.190.18.2.in-addr.arpa
      IN PTR
      a2-18-190-79deploystaticakamaitechnologiescom
    • flag-us
      DNS
      64.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      64.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      4.38.16.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      4.38.16.2.in-addr.arpa
      IN PTR
      Response
      4.38.16.2.in-addr.arpa
      IN PTR
      a2-16-38-4deploystaticakamaitechnologiescom
    • flag-us
      DNS
      212.20.149.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      212.20.149.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      15.164.165.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      15.164.165.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      166.190.18.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      166.190.18.2.in-addr.arpa
      IN PTR
      Response
      166.190.18.2.in-addr.arpa
      IN PTR
      a2-18-190-166deploystaticakamaitechnologiescom
    • flag-us
      DNS
      77.190.18.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      77.190.18.2.in-addr.arpa
      IN PTR
      Response
      77.190.18.2.in-addr.arpa
      IN PTR
      a2-18-190-77deploystaticakamaitechnologiescom
    • flag-us
      DNS
      21.236.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      21.236.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      11.173.189.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      11.173.189.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      3.108.50.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      3.108.50.23.in-addr.arpa
      IN PTR
      Response
      3.108.50.23.in-addr.arpa
      IN PTR
      a23-50-108-3deploystaticakamaitechnologiescom
    No results found
    • 8.8.8.8:53
      8.8.8.8.in-addr.arpa
      dns
      66 B
       90 B
       1
      1

      DNS Request

      8.8.8.8.in-addr.arpa

    • 8.8.8.8:53
      58.55.71.13.in-addr.arpa
      dns
      70 B
       144 B
       1
      1

      DNS Request

      58.55.71.13.in-addr.arpa

    • 8.8.8.8:53
      79.190.18.2.in-addr.arpa
      dns
      70 B
       133 B
       1
      1

      DNS Request

      79.190.18.2.in-addr.arpa

    • 8.8.8.8:53
      64.159.190.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      64.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      4.38.16.2.in-addr.arpa
      dns
      68 B
       129 B
       1
      1

      DNS Request

      4.38.16.2.in-addr.arpa

    • 8.8.8.8:53
      212.20.149.52.in-addr.arpa
      dns
      72 B
       146 B
       1
      1

      DNS Request

      212.20.149.52.in-addr.arpa

    • 8.8.8.8:53
      15.164.165.52.in-addr.arpa
      dns
      72 B
       146 B
       1
      1

      DNS Request

      15.164.165.52.in-addr.arpa

    • 8.8.8.8:53
      166.190.18.2.in-addr.arpa
      dns
      71 B
       135 B
       1
      1

      DNS Request

      166.190.18.2.in-addr.arpa

    • 8.8.8.8:53
      77.190.18.2.in-addr.arpa
      dns
      70 B
       133 B
       1
      1

      DNS Request

      77.190.18.2.in-addr.arpa

    • 8.8.8.8:53
      21.236.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      21.236.111.52.in-addr.arpa

    • 8.8.8.8:53
      11.173.189.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      11.173.189.20.in-addr.arpa

    • 8.8.8.8:53
      3.108.50.23.in-addr.arpa
      dns
      70 B
       133 B
       1
      1

      DNS Request

      3.108.50.23.in-addr.arpa

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.