Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
01/07/2026, 13:06
General
- Target PO-1400083954 pdf.js
- Size 4.0MB
- Sample260701-qccq7agy6z
- SHA256 1a6eaebdcc55c0ea88201ac996c3bca4a2d099aa52cd9c7d148f25539ac873bf
Malware Config
Extracted
-
xworm
-
5.0
-
104.239.66.42:7004
-
6YTpcx56HDXU7quN
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Executes dropped EXE 1 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\PO-1400083954 pdf.js"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\CWFIEVKMDKBJGKIY.PIF"C:\Users\Admin\Documents\CWFIEVKMDKBJGKIY.PIF" C:\Users\Admin\Documents\CWFIEVKMDKBJGKIY.ttf2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CWFIEVKMDKBJGKIY.PIF
CWFIEVKMDKBJGKIY.ttf
memory/1252-9-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-10-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-11-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-16-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-14-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-13-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-12-0x0000000000C30000-0x0000000000C31000-memory.dmp
memory/1252-15-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-17-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-18-0x0000000000C40000-0x0000000000C41000-memory.dmp
memory/1252-20-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-19-0x0000000000C50000-0x0000000000C51000-memory.dmp
memory/1252-21-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-22-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-23-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-25-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-29-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-28-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-27-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-26-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-24-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-30-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-31-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-32-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-34-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-36-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-35-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-33-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-37-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-72-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-147-0x0000000074942000-0x0000000074943000-memory.dmp
memory/1252-71-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-70-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-69-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-68-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-66-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-64-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-65-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-53-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-50-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-49-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-48-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-47-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-67-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-63-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-62-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-61-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-59-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-60-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-58-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-57-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-56-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-55-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-54-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-52-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-51-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-45-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-46-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-44-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-43-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-42-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-41-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-40-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-39-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-38-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1252-148-0x0000000026FB0000-0x0000000026FBE000-memory.dmp
memory/1252-149-0x0000000029740000-0x00000000297DC000-memory.dmp
memory/1252-150-0x0000000074930000-0x00000000750EC000-memory.dmp
memory/1252-151-0x0000000074930000-0x00000000750EC000-memory.dmp
memory/1252-152-0x0000000074930000-0x00000000750EC000-memory.dmp
memory/1252-153-0x0000000074942000-0x0000000074943000-memory.dmp
memory/1252-154-0x0000000074930000-0x00000000750EC000-memory.dmp
memory/1252-156-0x0000000029C90000-0x0000000029CF6000-memory.dmp
memory/1252-157-0x0000000074930000-0x00000000750EC000-memory.dmp
memory/1252-158-0x000000002B350000-0x000000002B3E2000-memory.dmp
memory/1252-159-0x000000002B3F0000-0x000000002B9AA000-memory.dmp
memory/1252-160-0x000000002CE30000-0x000000002CF96000-memory.dmp
memory/1252-162-0x000000002CFB0000-0x000000002CFBA000-memory.dmp
memory/1252-163-0x000000002C800000-0x000000002C9C2000-memory.dmp