Overview

overview

10

Static

static

5

03f310b3ee...86.exe

windows10-2004-x64

7

03f310b3ee...86.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    14/04/2026, 03:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    03f310b3ee74314ee32138b0d372ca193c1598f2aab2fd3886cf211f9f949e86.exe
  • Size 1.9MB
  • Sample260414-dwlf8aew6v
  • SHA256 03f310b3ee74314ee32138b0d372ca193c1598f2aab2fd3886cf211f9f949e86
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryxwormrattrojan

Malware Config

Extracted

Family

  • xworm

Version

  • 5.0

C2

  • 46.151.182.18:5500

  • overgainweb.duckdns.org:5500

  • overgaainweb.ddnsgeek.com:5500

Mutex

  • MCSqowSSQZa1gJP4

Attributes
  • install_file

    USB.exe

aes.plain

Signatures

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Detect Xworm Payload 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 13 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3132
      • C:\Users\Admin\AppData\Local\Temp\03f310b3ee74314ee32138b0d372ca193c1598f2aab2fd3886cf211f9f949e86.exe
        "C:\Users\Admin\AppData\Local\Temp\03f310b3ee74314ee32138b0d372ca193c1598f2aab2fd3886cf211f9f949e86.exe"
        2⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4784
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NetworkSubMask.bat""
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5056
          • C:\Users\Admin\AppData\Local\Temp\ILovePDFConfiguration\ILovePDFConvert.src
            "C:\Users\Admin\AppData\Local\Temp\ILovePDFConfiguration\ILovePDFConvert.src" "C:\Users\Admin\AppData\Local\Temp\ILovePDFConfiguration\PDFReaderTxT.html"
            4⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Drops startup file
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:1160
      • C:\Windows\SysWOW64\cmd.exe
        cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartupQuzMuzWara.url" & echo URL="C:\Users\Admin\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartupQuzMuzWara.url" & exit
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1600
      • C:\Users\Admin\AppData\Local\Temp\ILovePDFConfiguration\jsc.exe
        C:\Users\Admin\AppData\Local\Temp\ILovePDFConfiguration\jsc.exe
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2148

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          ILovePDFConvert.src
          • Path C:\Users\Admin\AppData\Local\Temp\ILovePDFConfiguration\ILovePDFConvert.src
          • Size 925KB
          • SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PDFReaderTxT.html
          • Path C:\Users\Admin\AppData\Local\Temp\ILovePDFConfiguration\PDFReaderTxT.html
          • Size 526KB
          • SHA256 7b501892517220423f80fa8b190d2beabb02636eaae8575db5bffeda78e18f3a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jsc.exe
          • Path C:\Users\Admin\AppData\Local\Temp\ILovePDFConfiguration\jsc.exe
          • Size 46KB
          • SHA256 ffec0de61d7accbda9d57ee5b297fcd4725e971a061da41ad0c5751c496ef6a4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NetworkSubMask.bat
          • Path C:\Users\Admin\AppData\Local\Temp\NetworkSubMask.bat
          • Size 155B
          • SHA256 d1b3b3c8f089faae7e72f9e48718d42e2698e37da78fb5b776733c15749e59af
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/2148-17-0x0000000001210000-0x0000000001220000-memory.dmp
          Download

          memory/2148-20-0x0000000005800000-0x000000000589C000-memory.dmp
          Download

          memory/2148-22-0x00000000060A0000-0x0000000006646000-memory.dmp
          Download

          memory/2148-23-0x0000000006850000-0x00000000068E2000-memory.dmp
          Download

          memory/2148-24-0x0000000006040000-0x000000000604A000-memory.dmp
          Download

          memory/2148-25-0x0000000006C20000-0x0000000006C86000-memory.dmp
          Download