Analysis
- max time kernel
179s - max time network
177s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
25/02/2026, 04:12
General
- Target DOCUMENTOS DE JUZGADO PENAL CON FUNCION DE CONTROL DE GARANTIAS/001_CITACION DEMANDA JUZGADO PENAL.PDF.exe
- Size 467KB
- Sample260225-esth4agy5c
- SHA256 0a0080a0cc608758bdc49748b1b4df67127f35fe42cd153658b6ee481f599705
Malware Config
Extracted
-
xworm
-
XWorm V6.4
-
envi2026fe.duckdns.org:5480
-
VOIfm3CY6bcfFilb
-
install_file
USB.exe
Signatures
- Detect Xworm Payload 3 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Loads dropped DLL 2 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DOCUMENTOS DE JUZGADO PENAL CON FUNCION DE CONTROL DE GARANTIAS\001_CITACION DEMANDA JUZGADO PENAL.PDF.exe"C:\Users\Admin\AppData\Local\Temp\DOCUMENTOS DE JUZGADO PENAL CON FUNCION DE CONTROL DE GARANTIAS\001_CITACION DEMANDA JUZGADO PENAL.PDF.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\BytClient.exeC:\Users\Admin\BytClient.exe2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\extprompt\XPFix.exe"C:\Users\Admin\AppData\Roaming\extprompt\XPFix.exe" "C:\Users\Admin\AppData\Roaming\extprompt\XPFix.exe" /u2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
325826C.tmp
F9C5D5D.tmp
F9C5D5D.tmp
XPFix.exe
BytClient.exe
memory/1884-51-0x00007FFE1EFC0000-0x00007FFE1F1C9000-memory.dmp
memory/2732-33-0x00000000037E0000-0x00000000037F0000-memory.dmp
memory/2732-36-0x0000000000E30000-0x0000000000E63000-memory.dmp
memory/2732-54-0x0000000007050000-0x00000000075F6000-memory.dmp
memory/2732-26-0x00007FFE1EFC0000-0x00007FFE1F1C9000-memory.dmp
memory/2732-53-0x0000000006A00000-0x0000000006A92000-memory.dmp
memory/2732-42-0x0000000000E30000-0x0000000000E63000-memory.dmp
memory/2732-27-0x0000000000E30000-0x0000000000E63000-memory.dmp
memory/2732-30-0x00000000008D0000-0x00000000008D1000-memory.dmp
memory/2732-31-0x00000000037E0000-0x00000000037F0000-memory.dmp
memory/2732-32-0x0000000002810000-0x000000000281E000-memory.dmp
memory/2732-41-0x00000000037E0000-0x00000000037F0000-memory.dmp
memory/2732-34-0x00000000059B0000-0x0000000005A4C000-memory.dmp
memory/2732-35-0x00000000037E0000-0x00000000037F0000-memory.dmp
memory/2732-21-0x0000000000E30000-0x0000000000E63000-memory.dmp
memory/2732-37-0x00000000008D0000-0x00000000008D1000-memory.dmp
memory/2732-38-0x00000000037E0000-0x00000000037F0000-memory.dmp
memory/2732-39-0x00000000037E0000-0x00000000037F0000-memory.dmp
memory/2732-40-0x0000000005CC0000-0x0000000005D26000-memory.dmp
memory/5088-0-0x00000000740D0000-0x000000007411F000-memory.dmp
memory/5088-12-0x00000000740D0000-0x000000007411F000-memory.dmp
memory/5088-43-0x00000000740E7000-0x00000000740E8000-memory.dmp
memory/5088-14-0x00000000740D0000-0x000000007411F000-memory.dmp
memory/5088-11-0x00000000740E7000-0x00000000740E8000-memory.dmp
memory/5088-1-0x00007FFE1EFC0000-0x00007FFE1F1C9000-memory.dmp
memory/5088-17-0x00000000740D0000-0x000000007411F000-memory.dmp
memory/5088-19-0x00000000740D0000-0x000000007411F000-memory.dmp