darktortilla | 8f526c18a2151d5d43f9d3569696519bfb76a900fa8b7ff4e4f0100051730c8d

Analysis

max time kernel
149s
max time network
141s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
14/10/2025, 19:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Consulta n. 86267_14-10-25..exe
Size 707KB
Sample251014-ynzdbsdm7v
SHA256 8f526c18a2151d5d43f9d3569696519bfb76a900fa8b7ff4e4f0100051730c8d
MD5 b4a768830aefa1a351f5b239ffc9f6c5
SHA1 f8cf07f2f738fe518ff7a0595217a89e9f987e1f
SHA512 2f91fca32473ff549c5de15d56fe8c60fccce43b5c7591474f912f4e86c47aac70d40536faf98e91a7710c03c0ea3b55c2006fff886e897f7248f625733145e0
SSDEEP 12288:nOtj3VXlyxjS/gpKEtnMt/5OGpo5hcqOuvrhhcI:uF1icYGpoDcq7L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

crypter discovery darktortilla xworm loader persistence rat trojan

Malware Config

Extracted

Family

xworm

petro4prime.ydns.eu:5909

Attributes

Install_directory
%AppData%
install_file
PowerPoint.exe

Signatures

Darktortilla
DarkTortilla is a highly configurable .NET based crypter that delivers a wide range of information stealers.
loader crypter darktortilla
Darktortilla family
darktortilla

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3340-20-0x0000000000400000-0x0000000000416000-memory.dmp	family_xworm

Detects Darktortilla crypter. 1 IoCs

resource	yara_rule
behavioral2/memory/5744-6-0x0000000004FC0000-0x0000000005002000-memory.dmp	darktortilla

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerPoint.lnk	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerPoint.lnk	svchost.exe

Executes dropped EXE 7 IoCs

pid	Process
3752	svchost.exe
4972	svchost.exe
5116	svchost.exe
4952	svchost.exe
4452	svchost.exe
3340	svchost.exe
4540	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3625340254-1625357543-1797847221-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	reg.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5116 set thread context of 3340	5116	svchost.exe	92
PID 3752 set thread context of 4540	3752	svchost.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Consulta n. 86267_14-10-25..exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2368	cmd.exe
1268	PING.EXE
3648	cmd.exe
428	PING.EXE
2484	PING.EXE

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
1268	PING.EXE
428	PING.EXE
2484	PING.EXE

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
5744	Consulta n. 86267_14-10-25..exe
5744	Consulta n. 86267_14-10-25..exe
5744	Consulta n. 86267_14-10-25..exe
5744	Consulta n. 86267_14-10-25..exe
5744	Consulta n. 86267_14-10-25..exe
5744	Consulta n. 86267_14-10-25..exe
5744	Consulta n. 86267_14-10-25..exe
5744	Consulta n. 86267_14-10-25..exe
5744	Consulta n. 86267_14-10-25..exe
5744	Consulta n. 86267_14-10-25..exe
5744	Consulta n. 86267_14-10-25..exe
5744	Consulta n. 86267_14-10-25..exe
5744	Consulta n. 86267_14-10-25..exe
5744	Consulta n. 86267_14-10-25..exe
5744	Consulta n. 86267_14-10-25..exe
5744	Consulta n. 86267_14-10-25..exe
5744	Consulta n. 86267_14-10-25..exe
5744	Consulta n. 86267_14-10-25..exe
5744	Consulta n. 86267_14-10-25..exe
5744	Consulta n. 86267_14-10-25..exe
3752	svchost.exe
3752	svchost.exe
3752	svchost.exe
3752	svchost.exe
3752	svchost.exe
5116	svchost.exe
5116	svchost.exe
3752	svchost.exe
3752	svchost.exe
5116	svchost.exe
3752	svchost.exe
3752	svchost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5744	Consulta n. 86267_14-10-25..exe
Token: SeDebugPrivilege	3752	svchost.exe
Token: SeDebugPrivilege	5116	svchost.exe
Token: SeDebugPrivilege	3340	svchost.exe
Token: SeDebugPrivilege	4540	svchost.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 5744 wrote to memory of 2368	5744	Consulta n. 86267_14-10-25..exe	78
PID 5744 wrote to memory of 2368	5744	Consulta n. 86267_14-10-25..exe	78
PID 5744 wrote to memory of 2368	5744	Consulta n. 86267_14-10-25..exe	78
PID 2368 wrote to memory of 1268	2368	cmd.exe	80
PID 2368 wrote to memory of 1268	2368	cmd.exe	80
PID 2368 wrote to memory of 1268	2368	cmd.exe	80
PID 5744 wrote to memory of 3648	5744	Consulta n. 86267_14-10-25..exe	81
PID 5744 wrote to memory of 3648	5744	Consulta n. 86267_14-10-25..exe	81
PID 5744 wrote to memory of 3648	5744	Consulta n. 86267_14-10-25..exe	81
PID 3648 wrote to memory of 428	3648	cmd.exe	83
PID 3648 wrote to memory of 428	3648	cmd.exe	83
PID 3648 wrote to memory of 428	3648	cmd.exe	83
PID 2368 wrote to memory of 1644	2368	cmd.exe	84
PID 2368 wrote to memory of 1644	2368	cmd.exe	84
PID 2368 wrote to memory of 1644	2368	cmd.exe	84
PID 3648 wrote to memory of 2484	3648	cmd.exe	85
PID 3648 wrote to memory of 2484	3648	cmd.exe	85
PID 3648 wrote to memory of 2484	3648	cmd.exe	85
PID 3752 wrote to memory of 4972	3752	svchost.exe	88
PID 3752 wrote to memory of 4972	3752	svchost.exe	88
PID 3752 wrote to memory of 4972	3752	svchost.exe	88
PID 3752 wrote to memory of 4972	3752	svchost.exe	88
PID 3752 wrote to memory of 4972	3752	svchost.exe	88
PID 3752 wrote to memory of 4972	3752	svchost.exe	88
PID 3752 wrote to memory of 4972	3752	svchost.exe	88
PID 3752 wrote to memory of 4972	3752	svchost.exe	88
PID 3752 wrote to memory of 4952	3752	svchost.exe	89
PID 3752 wrote to memory of 4952	3752	svchost.exe	89
PID 3752 wrote to memory of 4952	3752	svchost.exe	89
PID 3752 wrote to memory of 4952	3752	svchost.exe	89
PID 3752 wrote to memory of 4952	3752	svchost.exe	89
PID 3752 wrote to memory of 4952	3752	svchost.exe	89
PID 3752 wrote to memory of 4952	3752	svchost.exe	89
PID 3752 wrote to memory of 4952	3752	svchost.exe	89
PID 3648 wrote to memory of 5116	3648	cmd.exe	90
PID 3648 wrote to memory of 5116	3648	cmd.exe	90
PID 3648 wrote to memory of 5116	3648	cmd.exe	90
PID 3752 wrote to memory of 4452	3752	svchost.exe	91
PID 3752 wrote to memory of 4452	3752	svchost.exe	91
PID 3752 wrote to memory of 4452	3752	svchost.exe	91
PID 3752 wrote to memory of 4452	3752	svchost.exe	91
PID 3752 wrote to memory of 4452	3752	svchost.exe	91
PID 3752 wrote to memory of 4452	3752	svchost.exe	91
PID 3752 wrote to memory of 4452	3752	svchost.exe	91
PID 3752 wrote to memory of 4452	3752	svchost.exe	91
PID 5116 wrote to memory of 3340	5116	svchost.exe	92
PID 5116 wrote to memory of 3340	5116	svchost.exe	92
PID 5116 wrote to memory of 3340	5116	svchost.exe	92
PID 5116 wrote to memory of 3340	5116	svchost.exe	92
PID 5116 wrote to memory of 3340	5116	svchost.exe	92
PID 5116 wrote to memory of 3340	5116	svchost.exe	92
PID 5116 wrote to memory of 3340	5116	svchost.exe	92
PID 5116 wrote to memory of 3340	5116	svchost.exe	92
PID 3752 wrote to memory of 4540	3752	svchost.exe	93
PID 3752 wrote to memory of 4540	3752	svchost.exe	93
PID 3752 wrote to memory of 4540	3752	svchost.exe	93
PID 3752 wrote to memory of 4540	3752	svchost.exe	93
PID 3752 wrote to memory of 4540	3752	svchost.exe	93
PID 3752 wrote to memory of 4540	3752	svchost.exe	93
PID 3752 wrote to memory of 4540	3752	svchost.exe	93
PID 3752 wrote to memory of 4540	3752	svchost.exe	93

C:\Users\Admin\AppData\Local\Temp\Consulta n. 86267_14-10-25..exe
"C:\Users\Admin\AppData\Local\Temp\Consulta n. 86267_14-10-25..exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5744
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c ping 127.0.0.1 -n 10 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "svchost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 10
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1268
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "svchost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:1644
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c ping 127.0.0.1 -n 9 > nul && copy "C:\Users\Admin\AppData\Local\Temp\Consulta n. 86267_14-10-25..exe" "C:\Users\Admin\AppData\Roaming\svchost.exe" && ping 127.0.0.1 -n 9 > nul && "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3648
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 9
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:428
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 9
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2484
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5116
  - - C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3340

C:\Users\Admin\AppData\Roaming\svchost.exe
C:\Users\Admin\AppData\Roaming\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\svchost.exe.log
Size 1KB
SHA256 b5e2d2dc85e12de6818fb7bc591a15b66a508610f2ecec1d92547907cb57a9be
MD5 d7dd8577a6c5a7779f2b89990673ceaf
SHA1 8ef5bac398ef64b111ff9ce59de164e859c4f057
SHA512 73ea6fb8fa9d0e36a56e832f9d484d139b298d2e74ea48c663a128aed74dcd397bda353b6bcab27ac1b164da1c0ebda4f9271676f28f68da108f410b1a8a8dba
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 707KB
SHA256 8f526c18a2151d5d43f9d3569696519bfb76a900fa8b7ff4e4f0100051730c8d
MD5 b4a768830aefa1a351f5b239ffc9f6c5
SHA1 f8cf07f2f738fe518ff7a0595217a89e9f987e1f
SHA512 2f91fca32473ff549c5de15d56fe8c60fccce43b5c7591474f912f4e86c47aac70d40536faf98e91a7710c03c0ea3b55c2006fff886e897f7248f625733145e0
SSDEEP 12288:nOtj3VXlyxjS/gpKEtnMt/5OGpo5hcqOuvrhhcI:uF1icYGpoDcq7L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3340-30-0x0000000006A40000-0x0000000006AA6000-memory.dmp

Download

memory/3340-20-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/3752-14-0x0000000007E50000-0x0000000007E56000-memory.dmp

Download

memory/3752-13-0x00000000075F0000-0x0000000007606000-memory.dmp

Download

memory/5116-18-0x00000000073D0000-0x00000000073E6000-memory.dmp

Download

memory/5744-3-0x0000000004F20000-0x0000000004FB2000-memory.dmp

Download

memory/5744-7-0x00000000051A0000-0x00000000051B0000-memory.dmp

Download

memory/5744-6-0x0000000004FC0000-0x0000000005002000-memory.dmp

Download

memory/5744-5-0x0000000004E50000-0x0000000004E5A000-memory.dmp

Download

memory/5744-4-0x00000000051A0000-0x00000000051B0000-memory.dmp

Download

memory/5744-0-0x0000000000200000-0x00000000002B8000-memory.dmp

Download

memory/5744-2-0x0000000004E80000-0x0000000004F1C000-memory.dmp

Download

memory/5744-1-0x0000000005430000-0x00000000059D6000-memory.dmp

Download