Analysis
- max time kernel
149s - max time network
99s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/04/2026, 04:32
General
- Target X-Scan-v3.3/._cache_xscan_gui.exe
- Size 1.7MB
- Sample260415-e55f5ah171
- SHA256 1c2e4984aeb420f9e7af69f8c941ecf5226b70644d43e98963be47dbb88c4f7f
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
- Drops file in System32 directory 4 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: LoadsDriver 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\X-Scan-v3.3\._cache_xscan_gui.exe"C:\Users\Admin\AppData\Local\Temp\X-Scan-v3.3\._cache_xscan_gui.exe"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\X-Scan-v3.3\dat\xpf.sysC:\Users\Admin\AppData\Local\Temp\X-Scan-v3.3\dat\xpf.sys1⤵
-
C:\Windows\system32\drivers\ipfltdrv.sysC:\Windows\system32\drivers\ipfltdrv.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4636-0-0x0000000000790000-0x00000000007A5000-memory.dmp
memory/4636-1-0x00000000007B0000-0x00000000007C0000-memory.dmp
memory/4636-2-0x00000000026B0000-0x00000000026B1000-memory.dmp
memory/4636-6-0x0000000002BC0000-0x0000000002BD9000-memory.dmp
memory/4636-7-0x0000000002BC0000-0x0000000002BE0000-memory.dmp
memory/4636-8-0x00000000046B0000-0x000000000472A000-memory.dmp
memory/4636-9-0x00000000046B0000-0x0000000004720000-memory.dmp
memory/4636-10-0x0000000002BC0000-0x0000000002BDF000-memory.dmp
memory/4636-11-0x0000000002BC0000-0x0000000002BE1000-memory.dmp
memory/4636-12-0x0000000004930000-0x0000000004A03000-memory.dmp
memory/4636-13-0x00000000046B0000-0x00000000046D7000-memory.dmp
memory/4636-15-0x0000000002BC0000-0x0000000002BDF000-memory.dmp
memory/4636-20-0x0000000002BC0000-0x0000000002BE1000-memory.dmp
memory/4636-24-0x0000000002BC0000-0x0000000002BDF000-memory.dmp
memory/4636-18-0x0000000002BE0000-0x0000000002C07000-memory.dmp
memory/4636-25-0x0000000002BC0000-0x0000000002BE0000-memory.dmp
memory/4636-33-0x0000000002BC0000-0x0000000002BE1000-memory.dmp
memory/4636-37-0x0000000002BC0000-0x0000000002BE0000-memory.dmp
memory/4636-29-0x0000000002BC0000-0x0000000002BE0000-memory.dmp
memory/4636-16-0x0000000002BC0000-0x0000000002BE0000-memory.dmp
memory/4636-41-0x0000000002BC0000-0x0000000002BE1000-memory.dmp
memory/4636-45-0x0000000002BC0000-0x0000000002BE0000-memory.dmp
memory/4636-53-0x0000000002BC0000-0x0000000002BE0000-memory.dmp
memory/4636-49-0x0000000002BC0000-0x0000000002BE0000-memory.dmp
memory/4636-57-0x0000000004930000-0x00000000049D7000-memory.dmp
memory/4636-58-0x0000000002BC0000-0x0000000002BDA000-memory.dmp
memory/4636-60-0x0000000004AE0000-0x0000000004BB3000-memory.dmp
memory/4636-59-0x0000000004930000-0x00000000049D5000-memory.dmp
memory/4636-65-0x0000000004BC0000-0x0000000004C3A000-memory.dmp
memory/4636-79-0x0000000002BF0000-0x0000000002C10000-memory.dmp
memory/4636-82-0x00000000046E0000-0x00000000046FA000-memory.dmp
memory/4636-81-0x0000000004E40000-0x0000000004EE7000-memory.dmp
memory/4636-80-0x0000000002BF0000-0x0000000002C10000-memory.dmp
memory/4636-77-0x00000000046E0000-0x0000000004701000-memory.dmp
memory/4636-78-0x0000000002BF0000-0x0000000002C10000-memory.dmp
memory/4636-76-0x0000000002BF0000-0x0000000002C10000-memory.dmp
memory/4636-75-0x00000000046E0000-0x0000000004701000-memory.dmp
memory/4636-74-0x0000000002BF0000-0x0000000002C10000-memory.dmp
memory/4636-73-0x0000000002BF0000-0x0000000002C10000-memory.dmp
memory/4636-72-0x0000000002BF0000-0x0000000002C0F000-memory.dmp
memory/4636-71-0x00000000046E0000-0x0000000004701000-memory.dmp
memory/4636-70-0x0000000002BF0000-0x0000000002C10000-memory.dmp
memory/4636-69-0x0000000002BF0000-0x0000000002C0F000-memory.dmp
memory/4636-68-0x00000000046E0000-0x0000000004701000-memory.dmp
memory/4636-66-0x0000000004BC0000-0x0000000004C30000-memory.dmp
memory/4636-64-0x0000000002BF0000-0x0000000002C10000-memory.dmp
memory/4636-63-0x0000000002BF0000-0x0000000002C09000-memory.dmp
memory/4636-67-0x0000000002BF0000-0x0000000002C0F000-memory.dmp
memory/4636-84-0x00000000026B0000-0x00000000026B1000-memory.dmp
memory/4636-83-0x0000000000400000-0x00000000005CB000-memory.dmp