Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    30s
  • max time network
    33s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250207-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/02/2025, 19:38

General

  • Target

    steam.exe

  • Size

    1005KB

  • MD5

    d393fb1b159fdc35e135960a8f8b2928

  • SHA1

    74f27229a212ceb1be49b6f1ae9093c9af5fe0c2

  • SHA256

    6cb5005a2a43e0ca027de531c844c00935940df89d797b67f47d4399b89d3bf4

  • SHA512

    bda698fc1d1c8893fe688ea82f83bddcb56a009fd1155cfe25683bd87d71c6f1232059e4d5f6c7f17865c3fd8bd5aa32b306b63aa59c78a82776f69e772d0b98

  • SSDEEP

    6144:d4lrV3oawRMA8RixB9+5FUd0f1Ky5xg+GIIIIIIIhIIIIIIIIIIIIIIIU:qlVoawO5Qj9+5FdfEy/

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot7602843389:AAE9dcCKuyUGx9HUNQf9KbsZDhME6HwC10g/sendMessage?chat_id=1745421249

Extracted

Family

xworm

C2

127.0.0.1:2727

dnsdeerrorlehaxor.ddns.net:2727

Attributes
  • Install_directory

    %Public%

  • install_file

    Discord.exe

  • telegram

    https://api.telegram.org/bot5964175002:AAFK1mpStrMUWwegniLJuryZjOhVavZhSGo/sendMessage?chat_id=1745421249

Signatures

  • Detect Xworm Payload 2 IoCs
  • Phemedrone

    An information and wallet stealer written in C#.

  • Phemedrone family
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\steam.exe
    "C:\Users\Admin\AppData\Local\Temp\steam.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4576
    • C:\Users\Public\Discord.exe
      "C:\Users\Public\Discord.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:468
    • C:\Users\Public\Steam.exe
      "C:\Users\Public\Steam.exe"
      2⤵
      • Executes dropped EXE
      PID:836
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RUFGQ0Y3MzgtRTg0OS00QUJBLUI5NDItMDAyMTg0RUE1MUYzfSIgdXNlcmlkPSJ7RUE4NUIyNDQtQzhDNC00RjM5LTk5NkItNDdGMDQyRTI4RjZCfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QTRDNDlBODItMUMxQy00NUZELUI5NTktQzU0QzNEODY4ODZGfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDY0MzMiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODc1OTU2NTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0ODU1OTMzOTcwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:2404

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Public\Discord.exe

    Filesize

    340KB

    MD5

    93a84f8e3c8e40aa764215d360a89064

    SHA1

    5bf84da9f34ec2fd38bc175a8a890244409edca1

    SHA256

    18ebb82690ab22e2b00016bbd44df0ab1bd522d7231abe23e11cb56d33bbbe3f

    SHA512

    da313755609442286062a9be8754399c606c0071812ad7dfb9289d37e9b24ee8cc8688e6563f192dff9552355f917f25ee2ffe735a5e1fc876cfe4ce778cce34

  • C:\Users\Public\Steam.exe

    Filesize

    385KB

    MD5

    d5e9ca906c2366c7878fe7ff36587f6a

    SHA1

    be89988a517effb21f2e3a0c680f890708d95410

    SHA256

    25c49795584b8bd3dc5dc2be6e26cecf9dd0cef2323aa71089c1de01ac81dacc

    SHA512

    ec864f1fa9b7efac08baf3c1feb6626fa4832f76336921ec133aed1d4cfbe9fe8a05a70c0997e831383894d51d05bd4a8335d03353310808fd301bf112cf00ae

  • memory/468-26-0x0000000000590000-0x00000000005EC000-memory.dmp

    Filesize

    368KB

  • memory/468-27-0x00007FF947530000-0x00007FF947FF1000-memory.dmp

    Filesize

    10.8MB

  • memory/468-29-0x00007FF947530000-0x00007FF947FF1000-memory.dmp

    Filesize

    10.8MB

  • memory/836-25-0x000001C800950000-0x000001C8009B6000-memory.dmp

    Filesize

    408KB

  • memory/836-28-0x00007FF947530000-0x00007FF947FF1000-memory.dmp

    Filesize

    10.8MB

  • memory/4576-0-0x00007FF947533000-0x00007FF947535000-memory.dmp

    Filesize

    8KB

  • memory/4576-1-0x0000000000F00000-0x0000000001002000-memory.dmp

    Filesize

    1.0MB