Analysis
- max time kernel
149s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20251231-en - resource tags
- submitted
06/01/2026, 13:59
General
- Target 2e649994348e83344b0d3ba8aea4bbac4d095980fa1ccee677f59eae34d07df0.exe
- Size 10.0MB
- Sample260106-raqeyaax5b
- SHA256 2e649994348e83344b0d3ba8aea4bbac4d095980fa1ccee677f59eae34d07df0
Malware Config
Extracted
-
xworm
-
seller-editions.gl.at.ply.gg:54896
-
support-prospect.gl.at.ply.gg:54896
-
without-gibraltar.gl.at.ply.gg:54896
-
Install_directory
%LocalAppData%
-
install_file
injectTool.exe
Signatures
- Detect Xworm Payload 2 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 9 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e649994348e83344b0d3ba8aea4bbac4d095980fa1ccee677f59eae34d07df0.exe"C:\Users\Admin\AppData\Local\Temp\2e649994348e83344b0d3ba8aea4bbac4d095980fa1ccee677f59eae34d07df0.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\inject.exe"C:\Users\Admin\AppData\Local\Temp\inject.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\dsada.exe"C:\Users\Admin\AppData\Local\Temp\dsada.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dsada.exe"C:\Users\Admin\AppData\Local\Temp\dsada.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_bz2.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
auto.tcl
cp1252.enc
pkgIndex.tcl
init.tcl
pkgIndex.tcl
package.tcl
tclIndex
tm.tcl
button.tcl
entry.tcl
icons.tcl
listbox.tcl
menu.tcl
panedwindow.tcl
pkgIndex.tcl
scale.tcl
scrlbar.tcl
spinbox.tcl
text.tcl
tk.tcl
button.tcl
combobox.tcl
cursors.tcl
entry.tcl
fonts.tcl
menubutton.tcl
notebook.tcl
panedwindow.tcl
progress.tcl
scale.tcl
scrollbar.tcl
spinbox.tcl
ttk.tcl
utils.tcl
_tkinter.pyd
base_library.zip
libcrypto-3.dll
python313.dll
select.pyd
tcl86t.dll
msgcat-1.6.1.tm
tk86t.dll
unicodedata.pyd
zlib1.dll
dsada.exe
inject.exe
memory/3192-1024-0x00007FF9DB2C0000-0x00007FF9DB2E9000-memory.dmp
memory/3192-1023-0x0000028F5AC00000-0x0000028F5B252000-memory.dmp
memory/3316-19-0x0000000000400000-0x0000000000E01000-memory.dmp
memory/3416-969-0x000000001B660000-0x000000001B670000-memory.dmp
memory/3416-11-0x0000000000960000-0x000000000098C000-memory.dmp