Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20250217-en -
resource tags
-
submitted
01/03/2025, 21:02
General
-
Target
Lunar.exe
-
Size
80KB
-
MD5
a8687c2e5769b266f3fe11ef05a8249a
-
SHA1
6dd43454da185a1127642ce51f330f9ade4eb7fe
-
SHA256
d73697ae10436a1b966945aeb1ddba7be5a2d0fdf417cf8cd0d18374036932e1
-
SHA512
380e910f91bb600a8fb93a17b5777015e33f50864103d769644a3819a5a98198872fb389ff3dbd6d69f282bdce5b050e329851ad93870b61a7f66a6f84a11856
-
SSDEEP
1536:1zlXpX58pUSqE9tkkHwQxuCbTGKQqmEZ6CZODSkCjedHs:v/X21x3bTGKQCBZOWkCjcs
Score
10/10
Malware Config
Extracted
Family
xworm
C2
Clientbtufasf-31464.portmap.host:31464
Attributes
-
Install_directory
%AppData%
-
install_file
svchost.exe
-
telegram
https://api.telegram.org/bot7911535650:AAEUAqRiUefpOJv3v-yDVQta9ZM8Lvmwl88/sendMessage?chat_id=6426180826
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lunar.exe"C:\Users\Admin\AppData\Local\Temp\Lunar.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
104KB
-
Filesize
10.8MB
-
Filesize
10.8MB