Analysis
- user interaction
yes - max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20251229-en - resource tags
- submitted
15/01/2026, 14:17
General
- Target Mail Access Checker by xRisky v2 CRACKED.exe
- Size 68.1MB
- Sample260115-rl5c8scv4f
- SHA256 1f20bc1d4745fb8a38e11313f6b7e09e3094a1b9bc48359133a2916a4056a140
Malware Config
Extracted
-
xworm
-
3.1
-
uogapk7.ddns.net:4444
-
Install_directory
%AppData%
-
install_file
USBCheck.exe
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Executes dropped EXE 7 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- ConfuserEx .NET packer 2 IoCs
Detects ConfuserEx .NET packer.
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mail Access Checker by xRisky v2 CRACKED.exe"C:\Users\Admin\AppData\Local\Temp\Mail Access Checker by xRisky v2 CRACKED.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Mail Access Checker by xRisky v2 CRACKED.exe"C:\Users\Admin\AppData\Roaming\Mail Access Checker by xRisky v2 CRACKED.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe"C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe"C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe"3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'MicrosoftHandler.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "MicrosoftHandler" /tr "C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe"4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exeC:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe"C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exeC:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe"C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
Mail Access Checker by xRisky v2 CRACKED.exe.log
MicrosoftHandler.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_gq4csepw.vag.ps1
MicrosoftHandler.exe
memory/364-197-0x0000000070670000-0x00000000706BC000-memory.dmp
memory/2308-214-0x0000000070670000-0x00000000706BC000-memory.dmp
memory/2400-0-0x00000000006B0000-0x0000000004AD8000-memory.dmp
memory/3824-82-0x0000000002C20000-0x0000000002C4C000-memory.dmp
memory/3824-90-0x0000000007950000-0x000000000795A000-memory.dmp
memory/3824-144-0x0000000002BF0000-0x0000000002C0C000-memory.dmp
memory/3824-105-0x0000000007A40000-0x0000000007AB6000-memory.dmp
memory/3824-145-0x00000000050C0000-0x00000000050DE000-memory.dmp
memory/3824-85-0x00000000029C0000-0x00000000029C6000-memory.dmp
memory/3824-81-0x00000000007B0000-0x00000000007D8000-memory.dmp
memory/3824-84-0x00000000075B0000-0x0000000007642000-memory.dmp
memory/3824-83-0x0000000007AC0000-0x0000000008064000-memory.dmp
memory/3936-183-0x0000000007140000-0x0000000007154000-memory.dmp
memory/3936-163-0x0000000005620000-0x0000000005974000-memory.dmp
memory/3936-177-0x0000000007540000-0x0000000007BBA000-memory.dmp
memory/3936-178-0x0000000006F00000-0x0000000006F1A000-memory.dmp
memory/3936-175-0x0000000006D90000-0x0000000006DAE000-memory.dmp
memory/3936-179-0x0000000006F70000-0x0000000006F7A000-memory.dmp
memory/3936-167-0x0000000070670000-0x00000000706BC000-memory.dmp
memory/3936-166-0x0000000006D50000-0x0000000006D82000-memory.dmp
memory/3936-165-0x0000000005C10000-0x0000000005C5C000-memory.dmp
memory/3936-180-0x0000000007180000-0x0000000007216000-memory.dmp
memory/3936-164-0x0000000005BD0000-0x0000000005BEE000-memory.dmp
memory/3936-176-0x0000000006DC0000-0x0000000006E63000-memory.dmp
memory/3936-155-0x00000000055B0000-0x0000000005616000-memory.dmp
memory/3936-181-0x0000000007100000-0x0000000007111000-memory.dmp
memory/3936-154-0x0000000004DB0000-0x0000000004E16000-memory.dmp
memory/3936-153-0x0000000004D10000-0x0000000004D32000-memory.dmp
memory/3936-152-0x0000000004F10000-0x0000000005538000-memory.dmp
memory/3936-151-0x00000000022B0000-0x00000000022E6000-memory.dmp
memory/3936-185-0x0000000007220000-0x0000000007228000-memory.dmp
memory/3936-182-0x0000000007130000-0x000000000713E000-memory.dmp
memory/3936-184-0x0000000007240000-0x000000000725A000-memory.dmp
memory/5464-146-0x0000000000400000-0x0000000000418000-memory.dmp
memory/5464-150-0x0000000005550000-0x00000000055EC000-memory.dmp
memory/6052-65-0x000000001D0D0000-0x000000001D0DA000-memory.dmp
memory/6052-87-0x000000001D340000-0x000000001D46A000-memory.dmp
memory/6052-27-0x000000001ABA0000-0x000000001AD40000-memory.dmp
memory/6052-106-0x000000001FE30000-0x00000000211BC000-memory.dmp
memory/6052-107-0x00000000211C0000-0x000000002170E000-memory.dmp
memory/6052-108-0x000000001F780000-0x000000001F878000-memory.dmp
memory/6052-109-0x000000001F880000-0x000000001F978000-memory.dmp
memory/6052-110-0x0000000022780000-0x000000002293E000-memory.dmp
memory/6052-111-0x0000000022940000-0x0000000022FEC000-memory.dmp
memory/6052-112-0x0000000022FF0000-0x00000000237CA000-memory.dmp
memory/6052-113-0x00000000240D0000-0x000000002447C000-memory.dmp
memory/6052-114-0x0000000024650000-0x0000000024AB8000-memory.dmp
memory/6052-115-0x0000000024AC0000-0x0000000024B32000-memory.dmp
memory/6052-116-0x0000000022370000-0x0000000022390000-memory.dmp
memory/6052-117-0x0000000024B30000-0x0000000024D44000-memory.dmp
memory/6052-118-0x0000000026440000-0x00000000264A8000-memory.dmp
memory/6052-119-0x00000000264E0000-0x0000000026502000-memory.dmp
memory/6052-120-0x000000001D670000-0x000000001D71D000-memory.dmp
memory/6052-122-0x0000000024480000-0x00000000244EB000-memory.dmp
memory/6052-121-0x000000001D0D0000-0x000000001D0D8000-memory.dmp
memory/6052-123-0x00000000244F0000-0x0000000024646000-memory.dmp
memory/6052-124-0x0000000026F10000-0x0000000026FBA000-memory.dmp
memory/6052-125-0x000000001D670000-0x000000001D71D000-memory.dmp
memory/6052-129-0x000000001ABA0000-0x000000001AD40000-memory.dmp
memory/6052-38-0x0000000180000000-0x0000000180005000-memory.dmp
memory/6052-62-0x000000001D0D0000-0x000000001D0DA000-memory.dmp
memory/6052-63-0x000000001D0D0000-0x000000001D0DA000-memory.dmp
memory/6052-37-0x0000000180000000-0x0000000180005000-memory.dmp
memory/6052-91-0x000000001D340000-0x000000001D46A000-memory.dmp
memory/6052-92-0x000000001D340000-0x000000001D46A000-memory.dmp
memory/6052-94-0x000000001F270000-0x000000001F292000-memory.dmp
memory/6052-95-0x000000001F270000-0x000000001F28C000-memory.dmp
memory/6052-96-0x000000001F270000-0x000000001F28C000-memory.dmp
memory/6052-98-0x000000001F270000-0x000000001F28C000-memory.dmp
memory/6052-100-0x000000001F270000-0x000000001F28C000-memory.dmp
memory/6052-102-0x000000001F270000-0x000000001F28C000-memory.dmp
memory/6052-104-0x000000001F270000-0x000000001F28C000-memory.dmp
memory/6052-93-0x000000001D340000-0x000000001D46A000-memory.dmp
memory/6052-89-0x000000001D340000-0x000000001D46A000-memory.dmp
memory/6052-88-0x000000001D340000-0x000000001D46A000-memory.dmp
memory/6052-67-0x000000001D0D0000-0x000000001D0DA000-memory.dmp
memory/6052-78-0x000000001D720000-0x000000001D72A000-memory.dmp
memory/6052-79-0x000000001D720000-0x000000001D72A000-memory.dmp
memory/6052-80-0x000000001D720000-0x000000001D72A000-memory.dmp
memory/6052-76-0x00007FFA097C0000-0x00007FFA0990E000-memory.dmp
memory/6052-75-0x000000001D720000-0x000000001D72A000-memory.dmp
memory/6052-40-0x0000000180000000-0x0000000180005000-memory.dmp
memory/6052-48-0x000000001CFB0000-0x000000001D0DA000-memory.dmp
memory/6052-49-0x000000001CFB0000-0x000000001D0DA000-memory.dmp
memory/6052-61-0x000000001D340000-0x000000001D46A000-memory.dmp
memory/6052-53-0x000000001CFB0000-0x000000001D0DA000-memory.dmp
memory/6052-42-0x0000000180000000-0x0000000180005000-memory.dmp
memory/6052-44-0x0000000180000000-0x0000000180005000-memory.dmp
memory/6052-28-0x000000001ABA0000-0x000000001AD40000-memory.dmp
memory/6052-26-0x000000001ABA0000-0x000000001AD40000-memory.dmp
memory/6052-21-0x00007FFA0BA10000-0x00007FFA0C4D1000-memory.dmp