Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
16/06/2026, 12:01
General
- Target COTIZACION.exe
- Size 875KB
- Sample260616-n69a5sdw2w
- SHA256 d56bd06a68d33a1d07b75d1caec577a592dc7ea893d34153746b0d4cec21de58
Malware Config
Extracted
-
xworm
-
petro4prime.ydns.eu:5909
-
Install_directory
%AppData%
-
install_file
PowerPoint.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Drops startup file 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\COTIZACION.exe"C:\Users\Admin\AppData\Local\Temp\COTIZACION.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\COTIZACION.exe"C:\Users\Admin\AppData\Local\Temp\COTIZACION.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\COTIZACION.exe"C:\Users\Admin\AppData\Local\Temp\COTIZACION.exe"2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
COTIZACION.exe.log
memory/2904-264-0x0000000000400000-0x0000000000416000-memory.dmp
memory/2904-269-0x00000000051C0000-0x00000000051D0000-memory.dmp
memory/2904-270-0x0000000005C90000-0x0000000005CF6000-memory.dmp
memory/2904-271-0x00000000051C0000-0x00000000051D0000-memory.dmp
memory/3636-91-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-100-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-2-0x0000000005810000-0x00000000058A2000-memory.dmp
memory/3636-3-0x00000000058F0000-0x000000000598C000-memory.dmp
memory/3636-4-0x0000000005AD0000-0x0000000005AE0000-memory.dmp
memory/3636-5-0x0000000005990000-0x0000000005A08000-memory.dmp
memory/3636-6-0x0000000005A50000-0x0000000005A5A000-memory.dmp
memory/3636-7-0x0000000007540000-0x0000000007582000-memory.dmp
memory/3636-8-0x0000000005AD0000-0x0000000005AE0000-memory.dmp
memory/3636-9-0x0000000005AD0000-0x0000000005AE0000-memory.dmp
memory/3636-10-0x0000000005AD0000-0x0000000005AE0000-memory.dmp
memory/3636-11-0x0000000007D70000-0x0000000007DB2000-memory.dmp
memory/3636-21-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-29-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-137-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-135-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-260-0x0000000007DD0000-0x0000000007DD1000-memory.dmp
memory/3636-133-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-131-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-129-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-127-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-125-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-121-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-119-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-117-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-115-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-111-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-109-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-107-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-103-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-101-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-83-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-97-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-95-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-93-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-0-0x0000000000C40000-0x0000000000D22000-memory.dmp
memory/3636-89-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-87-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-1-0x0000000005EA0000-0x0000000006446000-memory.dmp
memory/3636-85-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-69-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-77-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-76-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-73-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-71-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-79-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-67-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-65-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-63-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-61-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-57-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-55-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-53-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-51-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-49-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-47-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-45-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-43-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-41-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-39-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-35-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-33-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-31-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-27-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-25-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-23-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-19-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-17-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-123-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-113-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-105-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-81-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-59-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-37-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-15-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-13-0x0000000007D70000-0x0000000007DAD000-memory.dmp
memory/3636-12-0x0000000007D70000-0x0000000007DAD000-memory.dmp