Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20250207-en
  • resource tags

    arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
  • submitted
    22/03/2025, 06:10 UTC

General

  • Target

    4dac62ad007ffed0e0d4b738af6da8ec.exe

  • Size

    78KB

  • MD5

    4dac62ad007ffed0e0d4b738af6da8ec

  • SHA1

    91437886f46d83c6106497c42b18d977ebd77b4f

  • SHA256

    042263c682b6bb02efb4d42de2b13ab4c56ef56ffb740ea2be36fce7dd61aba4

  • SHA512

    7e1434e2989dc57a4d632e4c6983a76d34e1ca45ae2493ac917bbef4dbb1e360567abad32c25a670bb4b379b50c1b4483332ecfa7d8ace8ee2fd6cb80631732f

  • SSDEEP

    1536:IbhBwtZA8wBpQzZkgBzWr7qxKGpbheZMrezOnxlh6+4xZxOwqofoFKP:IbhOWBpQzZr5W/qbAWSzGfd43xOwqof7

Score
10/10

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:4758

108.77.173.66:4758

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4dac62ad007ffed0e0d4b738af6da8ec.exe
    "C:\Users\Admin\AppData\Local\Temp\4dac62ad007ffed0e0d4b738af6da8ec.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2948

Network

  • flag-us
    DNS
    ip-api.com
    4dac62ad007ffed0e0d4b738af6da8ec.exe
    Remote address:
    8.8.8.8:53
    Request
    ip-api.com
    IN A
    Response
    ip-api.com
    IN A
    208.95.112.1
  • flag-us
    GET
    http://ip-api.com/line/?fields=hosting
    4dac62ad007ffed0e0d4b738af6da8ec.exe
    Remote address:
    208.95.112.1:80
    Request
    GET /line/?fields=hosting HTTP/1.1
    Host: ip-api.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Sat, 22 Mar 2025 06:18:36 GMT
    Content-Type: text/plain; charset=utf-8
    Content-Length: 5
    Access-Control-Allow-Origin: *
    X-Ttl: 12
    X-Rl: 37
  • 208.95.112.1:80
    http://ip-api.com/line/?fields=hosting
    http
    4dac62ad007ffed0e0d4b738af6da8ec.exe
    310 B
    266 B
    5
    2

    HTTP Request

    GET http://ip-api.com/line/?fields=hosting

    HTTP Response

    200
  • 8.8.8.8:53
    ip-api.com
    dns
    4dac62ad007ffed0e0d4b738af6da8ec.exe
    56 B
    72 B
    1
    1

    DNS Request

    ip-api.com

    DNS Response

    208.95.112.1

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2948-0-0x000007FEF5DF3000-0x000007FEF5DF4000-memory.dmp

    Filesize

    4KB

  • memory/2948-1-0x0000000000950000-0x000000000096A000-memory.dmp

    Filesize

    104KB

  • memory/2948-2-0x000007FEF5DF0000-0x000007FEF67DC000-memory.dmp

    Filesize

    9.9MB

  • memory/2948-3-0x000007FEF5DF3000-0x000007FEF5DF4000-memory.dmp

    Filesize

    4KB

  • memory/2948-4-0x000007FEF5DF0000-0x000007FEF67DC000-memory.dmp

    Filesize

    9.9MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.