Analysis
- max time kernel
52s - max time network
46s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
27/06/2026, 21:12
General
- Target Crack_voicemod_pro.exe
- Size 437KB
- Sample260627-z2askady6p
- SHA256 7b28197bae5a7b1adce270e7a30cde871acdccf41510202f2c0239a7f98ca2f3
Malware Config
Extracted
-
xorium_stealer
-
https://api.telegram.org/bot8682644885:AAHrfOOWs0fXFP8aePz1G5SLePwYwyEqemo/sendDocument
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
Signatures
- Family: XoriumStealer
XoriumStealer is an information stealer written in C#.
- Detects XoriumStealer payload 2 IoCs
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 6 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 8 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks system information in the registry 2 TTPs 1 IoCs
System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory 6 IoCs
- Drops file in Windows directory 8 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 52 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_pro.exe"C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_pro.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mei44uuabaj9ctvf.exe"C:\Users\Admin\AppData\Local\Temp\mei44uuabaj9ctvf.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="?^>w{;,k{>"K{M" dir=in action=allow program="C:\Windows\System32\xdwdDefender.exe" enable=yes & exit3⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Windows\System32\xdwdDefender.exe" /RL HIGHEST & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Windows\System32\xdwdDefender.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Windows\Web\xdwdMalwareDef.exe" /RL HIGHEST & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Windows\Web\xdwdMalwareDef.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\xdwdDefender.exe"C:\Windows\System32\xdwdDefender.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\app.exe"C:\Users\Admin\AppData\Local\Temp\app.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Checks system information in the registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\plikan.exe"C:\Users\Admin\AppData\Local\Temp\plikan.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SYSTEM32\netsh.exe"netsh" wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\IntelixWifiExport_990c1ca941494e73957cdb78cd07b5cf"3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" wlan show profiles3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
C:\Windows\System32\xdwdDefender.exe"C:\Windows\System32\xdwdDefender.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Web\xdwdMalwareDef.exeC:\Windows\Web\xdwdMalwareDef.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\xdwdDefender.exeC:\Windows\System32\xdwdDefender.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Event Triggered Execution
2AppInit DLLs
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Event Triggered Execution
2AppInit DLLs
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
1Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
app.exe
mei44uuabaj9ctvf.exe
plikan.exe
xdwd.dll
memory/1584-45-0x00007FF793040000-0x00007FF79304D000-memory.dmp
memory/1628-36-0x00000178D2160000-0x00000178D21B0000-memory.dmp
memory/1628-31-0x00000178B6170000-0x00000178B61B2000-memory.dmp
memory/1628-43-0x00000178D0A00000-0x00000178D0A12000-memory.dmp
memory/4876-4-0x00007FF9F0120000-0x00007FF9F0AC4000-memory.dmp
memory/4876-32-0x00007FF9F0120000-0x00007FF9F0AC4000-memory.dmp
memory/4876-0-0x00007FF9F02AF000-0x00007FF9F02B0000-memory.dmp
memory/4876-2-0x00007FF9F0120000-0x00007FF9F0AC4000-memory.dmp
memory/4876-1-0x0000000000DC0000-0x0000000000E34000-memory.dmp
memory/5924-25-0x0000000000250000-0x00000000002D4000-memory.dmp
memory/5924-26-0x00007FF9F0120000-0x00007FF9F0AC4000-memory.dmp
memory/5924-27-0x00007FF9F0120000-0x00007FF9F0AC4000-memory.dmp
memory/5924-142-0x00007FF9F0120000-0x00007FF9F0AC4000-memory.dmp
memory/5924-156-0x00007FF9F0120000-0x00007FF9F0AC4000-memory.dmp