Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
11/05/2026, 13:28
General
- Target _6831d9a5713e7c87763f6f19b89ee89d9f6b1e272ff7cb43991bbd0a500f0842.exe
- Size 873KB
- Sample260511-qqmtbaaz8v
- SHA256 6831d9a5713e7c87763f6f19b89ee89d9f6b1e272ff7cb43991bbd0a500f0842
Malware Config
Extracted
-
xworm
-
petro4prime.ydns.eu:5909
-
Install_directory
%AppData%
-
install_file
PowerPoint.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Drops startup file 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\_6831d9a5713e7c87763f6f19b89ee89d9f6b1e272ff7cb43991bbd0a500f0842.exe"C:\Users\Admin\AppData\Local\Temp\_6831d9a5713e7c87763f6f19b89ee89d9f6b1e272ff7cb43991bbd0a500f0842.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_6831d9a5713e7c87763f6f19b89ee89d9f6b1e272ff7cb43991bbd0a500f0842.exe"C:\Users\Admin\AppData\Local\Temp\_6831d9a5713e7c87763f6f19b89ee89d9f6b1e272ff7cb43991bbd0a500f0842.exe"2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
_6831d9a5713e7c87763f6f19b89ee89d9f6b1e272ff7cb43991bbd0a500f0842.exe.log
memory/716-0-0x0000000000340000-0x0000000000420000-memory.dmp
memory/716-1-0x0000000005310000-0x00000000058B4000-memory.dmp
memory/716-2-0x0000000004D60000-0x0000000004DF2000-memory.dmp
memory/716-3-0x0000000004E00000-0x0000000004E9C000-memory.dmp
memory/716-4-0x0000000004CE0000-0x0000000004CF0000-memory.dmp
memory/716-5-0x00000000052A0000-0x00000000052DE000-memory.dmp
memory/716-6-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-13-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-55-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-129-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-131-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-127-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-278-0x00000000059F0000-0x00000000059F1000-memory.dmp
memory/716-279-0x0000000005A90000-0x0000000005A9A000-memory.dmp
memory/716-125-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-280-0x0000000004CE0000-0x0000000004CF0000-memory.dmp
memory/716-123-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-121-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-119-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-117-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-115-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-113-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-109-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-107-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-105-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-103-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-101-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-99-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-97-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-95-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-93-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-91-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-89-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-87-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-85-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-83-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-81-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-79-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-77-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-111-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-75-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-73-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-71-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-70-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-67-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-65-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-63-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-61-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-59-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-57-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-53-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-51-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-49-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-47-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-46-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-43-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-41-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-39-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-37-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-35-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-33-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-31-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-27-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-25-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-23-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-22-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-19-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-17-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-15-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-11-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-9-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-7-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-29-0x00000000052A0000-0x0000000005301000-memory.dmp
memory/716-281-0x0000000004CE0000-0x0000000004CF0000-memory.dmp
memory/716-283-0x0000000004CE0000-0x0000000004CF0000-memory.dmp
memory/716-286-0x0000000006850000-0x0000000006868000-memory.dmp
memory/716-287-0x0000000006B40000-0x0000000006B46000-memory.dmp
memory/1100-294-0x0000000000400000-0x0000000000416000-memory.dmp
memory/1100-300-0x0000000005540000-0x0000000005550000-memory.dmp
memory/1100-305-0x0000000005540000-0x0000000005550000-memory.dmp