Analysis
- max time kernel
120s - max time network
146s - platform
windows11-21h2_x64 - resource
win11-20251231-en - resource tags
- submitted
15/01/2026, 14:17
General
- Target Mail Access Checker by xRisky v2 CRACKED.exe
- Size 68.1MB
- Sample260115-rl5c8scv4f
- SHA256 1f20bc1d4745fb8a38e11313f6b7e09e3094a1b9bc48359133a2916a4056a140
Malware Config
Extracted
-
xworm
-
3.1
-
uogapk7.ddns.net:4444
-
Install_directory
%AppData%
-
install_file
USBCheck.exe
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Drops startup file 2 IoCs
- Executes dropped EXE 8 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- ConfuserEx .NET packer 2 IoCs
Detects ConfuserEx .NET packer.
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 15 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mail Access Checker by xRisky v2 CRACKED.exe"C:\Users\Admin\AppData\Local\Temp\Mail Access Checker by xRisky v2 CRACKED.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Mail Access Checker by xRisky v2 CRACKED.exe"C:\Users\Admin\AppData\Roaming\Mail Access Checker by xRisky v2 CRACKED.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe"C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe"C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe"C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'MicrosoftHandler.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "MicrosoftHandler" /tr "C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe"4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exeC:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe"C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe"C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exeC:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe"C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe"C:\Users\Admin\AppData\Roaming\MicrosoftHandler.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
Mail Access Checker by xRisky v2 CRACKED.exe.log
MicrosoftHandler.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_3iwul203.qqz.ps1
MicrosoftHandler.exe
memory/1052-63-0x0000000003370000-0x000000000339C000-memory.dmp
memory/1052-131-0x0000000003280000-0x000000000329C000-memory.dmp
memory/1052-48-0x0000000000EE0000-0x0000000000F08000-memory.dmp
memory/1052-89-0x00000000032D0000-0x00000000032D6000-memory.dmp
memory/1052-132-0x00000000058E0000-0x00000000058FE000-memory.dmp
memory/1052-105-0x0000000005DD0000-0x0000000005E46000-memory.dmp
memory/1052-104-0x00000000059E0000-0x00000000059EA000-memory.dmp
memory/1052-79-0x0000000008420000-0x00000000089C6000-memory.dmp
memory/1052-84-0x0000000007E70000-0x0000000007F02000-memory.dmp
memory/1340-186-0x0000000006360000-0x00000000066B7000-memory.dmp
memory/1340-188-0x000000006F950000-0x000000006F99C000-memory.dmp
memory/4384-174-0x0000000007CB0000-0x0000000007CC5000-memory.dmp
memory/4384-142-0x0000000005B00000-0x0000000005B66000-memory.dmp
memory/4384-166-0x0000000006CE0000-0x0000000006CFE000-memory.dmp
memory/4384-168-0x00000000080A0000-0x000000000871A000-memory.dmp
memory/4384-159-0x000000006F950000-0x000000006F99C000-memory.dmp
memory/4384-158-0x0000000006D00000-0x0000000006D34000-memory.dmp
memory/4384-169-0x0000000007A60000-0x0000000007A7A000-memory.dmp
memory/4384-152-0x0000000006890000-0x00000000068DC000-memory.dmp
memory/4384-176-0x0000000007DA0000-0x0000000007DA8000-memory.dmp
memory/4384-170-0x0000000007AD0000-0x0000000007ADA000-memory.dmp
memory/4384-151-0x0000000005D80000-0x0000000005D9E000-memory.dmp
memory/4384-149-0x0000000006490000-0x00000000067E7000-memory.dmp
memory/4384-171-0x0000000007D00000-0x0000000007D96000-memory.dmp
memory/4384-167-0x0000000007700000-0x00000000077A4000-memory.dmp
memory/4384-143-0x0000000005B70000-0x0000000005BD6000-memory.dmp
memory/4384-172-0x0000000007C70000-0x0000000007C81000-memory.dmp
memory/4384-141-0x0000000005860000-0x0000000005882000-memory.dmp
memory/4384-140-0x0000000005E60000-0x000000000648A000-memory.dmp
memory/4384-173-0x0000000007CA0000-0x0000000007CAE000-memory.dmp
memory/4384-139-0x0000000002EF0000-0x0000000002F26000-memory.dmp
memory/4384-175-0x0000000007DC0000-0x0000000007DDA000-memory.dmp
memory/4496-134-0x0000000000400000-0x0000000000418000-memory.dmp
memory/4496-138-0x0000000004EA0000-0x0000000004F3C000-memory.dmp
memory/4768-203-0x000000006F950000-0x000000006F99C000-memory.dmp
memory/4820-0-0x0000000000730000-0x0000000004B58000-memory.dmp
memory/4892-82-0x000000001E5B0000-0x000000001E5BA000-memory.dmp
memory/4892-67-0x000000001E5A0000-0x000000001E5AA000-memory.dmp
memory/4892-106-0x0000000020E10000-0x000000002219C000-memory.dmp
memory/4892-107-0x00000000221A0000-0x00000000226EE000-memory.dmp
memory/4892-108-0x00000000209A0000-0x0000000020A98000-memory.dmp
memory/4892-109-0x0000000020AF0000-0x0000000020BE8000-memory.dmp
memory/4892-110-0x0000000023C40000-0x0000000023DFE000-memory.dmp
memory/4892-111-0x0000000023E60000-0x000000002450C000-memory.dmp
memory/4892-112-0x0000000024670000-0x0000000024E4A000-memory.dmp
memory/4892-113-0x0000000025D20000-0x00000000260CC000-memory.dmp
memory/4892-115-0x0000000026770000-0x00000000267E2000-memory.dmp
memory/4892-116-0x00000000228B0000-0x00000000228D0000-memory.dmp
memory/4892-117-0x0000000026850000-0x0000000026A64000-memory.dmp
memory/4892-114-0x0000000026210000-0x0000000026678000-memory.dmp
memory/4892-118-0x0000000027FD0000-0x0000000028038000-memory.dmp
memory/4892-119-0x0000000028120000-0x0000000028142000-memory.dmp
memory/4892-120-0x0000000028F70000-0x000000002901A000-memory.dmp
memory/4892-121-0x0000000002150000-0x0000000002C12000-memory.dmp
memory/4892-125-0x00000000229E0000-0x0000000022AFE000-memory.dmp
memory/4892-124-0x00000000201D0000-0x00000000201F1000-memory.dmp
memory/4892-123-0x000000001E5A0000-0x000000001E5A8000-memory.dmp
memory/4892-122-0x000000001E410000-0x000000001E4FA000-memory.dmp
memory/4892-126-0x0000000002150000-0x0000000002C12000-memory.dmp
memory/4892-26-0x000000001B940000-0x000000001BAE0000-memory.dmp
memory/4892-28-0x000000001B940000-0x000000001BAE0000-memory.dmp
memory/4892-37-0x0000000180000000-0x0000000180005000-memory.dmp
memory/4892-38-0x0000000180000000-0x0000000180005000-memory.dmp
memory/4892-40-0x0000000180000000-0x0000000180005000-memory.dmp
memory/4892-42-0x0000000180000000-0x0000000180005000-memory.dmp
memory/4892-49-0x000000001DDE0000-0x000000001DF0A000-memory.dmp
memory/4892-50-0x000000001DDE0000-0x000000001DF0A000-memory.dmp
memory/4892-64-0x000000001E5A0000-0x000000001E5AA000-memory.dmp
memory/4892-65-0x000000001E5A0000-0x000000001E5AA000-memory.dmp
memory/4892-15-0x0000000002150000-0x0000000002C12000-memory.dmp
memory/4892-69-0x000000001E5A0000-0x000000001E5AA000-memory.dmp
memory/4892-77-0x000000001E5B0000-0x000000001E5BA000-memory.dmp
memory/4892-81-0x000000001E5B0000-0x000000001E5BA000-memory.dmp
memory/4892-153-0x0000000002150000-0x0000000002C12000-memory.dmp
memory/4892-86-0x000000001E0E0000-0x000000001E20A000-memory.dmp
memory/4892-87-0x000000001E0E0000-0x000000001E20A000-memory.dmp
memory/4892-90-0x000000001E0E0000-0x000000001E20A000-memory.dmp
memory/4892-91-0x000000001E0E0000-0x000000001E20A000-memory.dmp
memory/4892-92-0x000000001E0E0000-0x000000001E20A000-memory.dmp
memory/4892-94-0x0000000020100000-0x000000002011C000-memory.dmp
memory/4892-97-0x0000000020100000-0x000000002011C000-memory.dmp
memory/4892-99-0x0000000020100000-0x000000002011C000-memory.dmp
memory/4892-101-0x0000000020100000-0x000000002011C000-memory.dmp
memory/4892-95-0x0000000020100000-0x000000002011C000-memory.dmp
memory/4892-103-0x0000000020100000-0x000000002011C000-memory.dmp
memory/4892-93-0x0000000020100000-0x0000000020122000-memory.dmp
memory/4892-88-0x000000001E0E0000-0x000000001E20A000-memory.dmp
memory/4892-83-0x000000001E5B0000-0x000000001E5BA000-memory.dmp
memory/4892-78-0x00007FFDD6ED0000-0x00007FFDD701F000-memory.dmp
memory/4892-62-0x000000001E0E0000-0x000000001E20A000-memory.dmp
memory/4892-54-0x000000001DDE0000-0x000000001DF0A000-memory.dmp
memory/4892-44-0x0000000180000000-0x0000000180005000-memory.dmp
memory/4892-27-0x000000001B940000-0x000000001BAE0000-memory.dmp
memory/4892-213-0x0000000002150000-0x0000000002C12000-memory.dmp
memory/4892-218-0x0000000002150000-0x0000000002C12000-memory.dmp
memory/4892-223-0x0000000002150000-0x0000000002C12000-memory.dmp
memory/4892-231-0x0000000002150000-0x0000000002C12000-memory.dmp
memory/4892-236-0x0000000002150000-0x0000000002C12000-memory.dmp
memory/4892-242-0x0000000002150000-0x0000000002C12000-memory.dmp
memory/4892-248-0x0000000002150000-0x0000000002C12000-memory.dmp
memory/4892-253-0x0000000002150000-0x0000000002C12000-memory.dmp
memory/4892-261-0x0000000002150000-0x0000000002C12000-memory.dmp
memory/4892-266-0x0000000002150000-0x0000000002C12000-memory.dmp
memory/4892-271-0x0000000002150000-0x0000000002C12000-memory.dmp