Analysis
- max time kernel
149s - max time network
139s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
01/12/2025, 14:37
General
- Target STXF-COMMOSA_QUOTATION.....2025.exe
- Size 679KB
- Sample251201-ry87ysyqcs
- SHA256 73641a6dd5f95201524760fb4b5e951dba1fa239bce351d6e765021ab08de01f
Malware Config
Extracted
-
xworm
-
petro4prime.ydns.eu:5909
-
Install_directory
%AppData%
-
install_file
OneNote.exe
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Drops startup file 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\STXF-COMMOSA_QUOTATION.....2025.exe"C:\Users\Admin\AppData\Local\Temp\STXF-COMMOSA_QUOTATION.....2025.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\STXF-COMMOSA_QUOTATION.....2025.exe"C:\Users\Admin\AppData\Local\Temp\STXF-COMMOSA_QUOTATION.....2025.exe"2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2856-0-0x0000000000B20000-0x0000000000BD0000-memory.dmp
memory/2856-1-0x0000000005CC0000-0x0000000006266000-memory.dmp
memory/2856-2-0x0000000005710000-0x00000000057A2000-memory.dmp
memory/2856-3-0x00000000057B0000-0x000000000584C000-memory.dmp
memory/2856-4-0x0000000005600000-0x0000000005610000-memory.dmp
memory/2856-5-0x0000000005680000-0x000000000568A000-memory.dmp
memory/2856-6-0x00000000059A0000-0x00000000059D0000-memory.dmp
memory/2856-7-0x0000000005600000-0x0000000005610000-memory.dmp
memory/2856-8-0x0000000007710000-0x0000000007726000-memory.dmp
memory/2856-9-0x0000000009D20000-0x0000000009D26000-memory.dmp
memory/2856-10-0x0000000005600000-0x0000000005610000-memory.dmp
memory/2856-11-0x0000000005600000-0x0000000005610000-memory.dmp
memory/3564-12-0x0000000000400000-0x0000000000414000-memory.dmp
memory/3564-18-0x00000000058A0000-0x00000000058B0000-memory.dmp
memory/3564-19-0x0000000006330000-0x0000000006396000-memory.dmp
memory/3564-20-0x00000000058A0000-0x00000000058B0000-memory.dmp