Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/04/2026, 07:03
General
- Target COTIZACIÓN.exe
- Size 683KB
- Sample260415-hvrn3abv8x
- SHA256 08e41de61e3905ec85a0054033b69a51e9bd4ee9e0e565bf57c82e27821ff468
Malware Config
Extracted
-
xworm
-
petro4prime.ydns.eu:5909
-
Install_directory
%AppData%
-
install_file
PowerPoint.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Drops startup file 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\COTIZACIÓN.exe"C:\Users\Admin\AppData\Local\Temp\COTIZACIÓN.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\COTIZACIÓN.exe"C:\Users\Admin\AppData\Local\Temp\COTIZACIÓN.exe"2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
COTIZACIÓN.exe.log
memory/1396-29-0x0000000002830000-0x0000000002840000-memory.dmp
memory/1396-27-0x0000000004D50000-0x0000000004DDA000-memory.dmp
memory/1396-28-0x0000000000D70000-0x0000000000D7B000-memory.dmp
memory/1396-26-0x0000000002830000-0x0000000002840000-memory.dmp
memory/1396-21-0x0000000000800000-0x0000000000816000-memory.dmp
memory/3984-5-0x0000000004CF0000-0x0000000004CFA000-memory.dmp
memory/3984-6-0x0000000005010000-0x0000000005042000-memory.dmp
memory/3984-9-0x0000000004F90000-0x0000000004FA0000-memory.dmp
memory/3984-8-0x0000000000C80000-0x0000000000E2C000-memory.dmp
memory/3984-10-0x0000000004F90000-0x0000000004FA0000-memory.dmp
memory/3984-13-0x00000000071F0000-0x0000000007208000-memory.dmp
memory/3984-14-0x0000000009840000-0x0000000009846000-memory.dmp
memory/3984-7-0x0000000004F90000-0x0000000004FA0000-memory.dmp
memory/3984-20-0x0000000000C80000-0x0000000000E2C000-memory.dmp
memory/3984-0-0x0000000000120000-0x00000000001D2000-memory.dmp
memory/3984-4-0x0000000004F90000-0x0000000004FA0000-memory.dmp
memory/3984-3-0x0000000004DE0000-0x0000000004E7C000-memory.dmp
memory/3984-2-0x0000000004D40000-0x0000000004DD2000-memory.dmp
memory/3984-1-0x00000000052F0000-0x0000000005896000-memory.dmp