Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
09/02/2026, 09:25
General
- Target ᯮ臘 09.02.pdf.exe
- Size 663KB
- Sample260209-ldr52shz2f
- SHA256 de83d3dc06840a9ae03084051fca19f05922ee559a72b985b17c81db35f26174
Malware Config
Extracted
-
xworm
-
89.208.105.207:6000
-
OPg4cCPFrFAyNFPE
-
install_file
USB.exe
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ᯮ臘 09.02.pdf.exe"C:\Users\Admin\AppData\Local\Temp\ᯮ臘 09.02.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2716-0-0x0000000000DA0000-0x0000000000E4C000-memory.dmp
memory/2716-2-0x00000000058E0000-0x0000000005972000-memory.dmp
memory/2716-3-0x0000000005A20000-0x0000000005ABC000-memory.dmp
memory/2716-1-0x0000000005DF0000-0x0000000006396000-memory.dmp
memory/2716-4-0x0000000005C50000-0x0000000005C60000-memory.dmp
memory/2716-5-0x0000000005990000-0x000000000599A000-memory.dmp
memory/2716-6-0x0000000005BB0000-0x0000000005C02000-memory.dmp
memory/2716-20-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-74-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-72-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-70-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-68-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-66-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-62-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-60-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-58-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-104-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-130-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-128-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-126-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-120-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-118-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-116-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-110-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-108-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-481-0x0000000005C40000-0x0000000005C41000-memory.dmp
memory/2716-102-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-100-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-94-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-92-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-90-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-88-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-86-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-132-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-124-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-122-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-482-0x0000000006450000-0x0000000006466000-memory.dmp
memory/2716-114-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-483-0x0000000005C50000-0x0000000005C60000-memory.dmp
memory/2716-112-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-106-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-98-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-96-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-85-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-82-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-80-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-78-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-76-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-56-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-52-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-48-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-46-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-44-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-42-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-40-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-38-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-34-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-32-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-30-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-28-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-26-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-24-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-484-0x0000000007E60000-0x0000000007E76000-memory.dmp
memory/2716-18-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-485-0x000000000A4D0000-0x000000000A4D6000-memory.dmp
memory/2716-16-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-14-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-64-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-54-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-50-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-36-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-22-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-12-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-10-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-8-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-7-0x0000000005BB0000-0x0000000005C0F000-memory.dmp
memory/2716-486-0x0000000005C50000-0x0000000005C60000-memory.dmp
memory/2716-487-0x0000000005C50000-0x0000000005C60000-memory.dmp
memory/5980-490-0x0000000000400000-0x000000000040E000-memory.dmp
memory/5980-491-0x0000000005010000-0x0000000005020000-memory.dmp
memory/5980-492-0x0000000005520000-0x0000000005586000-memory.dmp
memory/5980-493-0x0000000005010000-0x0000000005020000-memory.dmp