Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
09/02/2026, 09:25
General
- Target OpenPdf.exe
- Size 663KB
- Sample260209-ldr52shz2f
- SHA256 de83d3dc06840a9ae03084051fca19f05922ee559a72b985b17c81db35f26174
Malware Config
Extracted
-
xworm
-
89.208.105.207:6000
-
OPg4cCPFrFAyNFPE
-
install_file
USB.exe
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\OpenPdf.exe"C:\Users\Admin\AppData\Local\Temp\OpenPdf.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2784-0-0x0000000000580000-0x000000000062C000-memory.dmp
memory/2784-3-0x0000000005130000-0x00000000051CC000-memory.dmp
memory/2784-2-0x0000000005090000-0x0000000005122000-memory.dmp
memory/2784-1-0x00000000055A0000-0x0000000005B44000-memory.dmp
memory/2784-4-0x00000000052A0000-0x00000000052B0000-memory.dmp
memory/2784-5-0x0000000005010000-0x000000000501A000-memory.dmp
memory/2784-6-0x00000000051D0000-0x0000000005222000-memory.dmp
memory/2784-7-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-60-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-96-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-132-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-130-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-128-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-126-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-481-0x0000000005260000-0x0000000005261000-memory.dmp
memory/2784-124-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-482-0x0000000005B70000-0x0000000005B86000-memory.dmp
memory/2784-483-0x00000000052A0000-0x00000000052B0000-memory.dmp
memory/2784-122-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-118-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-114-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-112-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-110-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-108-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-106-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-104-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-102-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-100-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-99-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-92-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-91-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-484-0x0000000006800000-0x0000000006816000-memory.dmp
memory/2784-88-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-485-0x0000000006B00000-0x0000000006B06000-memory.dmp
memory/2784-86-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-82-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-80-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-78-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-74-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-72-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-70-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-120-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-116-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-94-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-84-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-76-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-68-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-66-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-64-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-62-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-58-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-56-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-50-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-48-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-46-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-44-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-42-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-40-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-38-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-36-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-32-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-30-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-28-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-26-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-24-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-22-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-54-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-52-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-14-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-12-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-34-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-10-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-8-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-20-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-18-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-16-0x00000000051D0000-0x000000000522F000-memory.dmp
memory/2784-486-0x00000000052A0000-0x00000000052B0000-memory.dmp
memory/2784-487-0x00000000052A0000-0x00000000052B0000-memory.dmp
memory/5292-490-0x0000000000400000-0x000000000040E000-memory.dmp
memory/5292-491-0x0000000005690000-0x00000000056A0000-memory.dmp
memory/5292-492-0x0000000005B90000-0x0000000005BF6000-memory.dmp
memory/5292-493-0x0000000005690000-0x00000000056A0000-memory.dmp