Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
09/07/2026, 08:23
General
- Target Payment Advice - Advice Ref [A2sv8yynp3xe] ACH credits Customer Ref [2011001664] Second Party Ref[REM-204169].js
- Size 2.5MB
- Sample260709-kagpgafy8w
- SHA256 09edc26a677870826648f171934793b831705359b356e7436751aab956921fd9
Malware Config
Extracted
-
xworm
-
5.0
-
45.88.91.35:7004
-
rODQcbiQJcgAxoTh
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Executes dropped EXE 1 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 25 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Payment Advice - Advice Ref [A2sv8yynp3xe] ACH credits Customer Ref [2011001664] Second Party Ref[REM-204169].js"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\QUGSSLLRONQZGVID.PIF"C:\Users\Admin\Documents\QUGSSLLRONQZGVID.PIF" C:\Users\Admin\Documents\QUGSSLLRONQZGVID.ttf2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
prep_Activatable Class_Hermes_perf.cache
QUGSSLLRONQZGVID.PIF
QUGSSLLRONQZGVID.ttf
memory/1732-66-0x0000027B99360000-0x0000027B99380000-memory.dmp
memory/1732-44-0x0000027B88D40000-0x0000027B88D60000-memory.dmp
memory/1732-26-0x0000027B98DE0000-0x0000027B98EE0000-memory.dmp
memory/1732-24-0x0000027B85FD0000-0x0000027B85FF0000-memory.dmp
memory/1732-10-0x0000027B838B0000-0x0000027B839B0000-memory.dmp
memory/1732-9-0x0000027B838B0000-0x0000027B839B0000-memory.dmp
memory/1732-8-0x0000027B838B0000-0x0000027B839B0000-memory.dmp
memory/3132-162-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-163-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-167-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-168-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-166-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-173-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-172-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-171-0x0000000002400000-0x0000000002401000-memory.dmp
memory/3132-170-0x0000000000C00000-0x0000000000C01000-memory.dmp
memory/3132-169-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-164-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-165-0x0000000000BF0000-0x0000000000BF1000-memory.dmp
memory/3132-174-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-176-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-188-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-215-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-218-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-217-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-216-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-214-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-212-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-211-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-210-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-209-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-208-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-207-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-206-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-205-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-204-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-203-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-202-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-201-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-200-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-199-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-198-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-197-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-196-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-195-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-194-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-193-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-190-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-189-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-187-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-186-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-185-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-184-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-183-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-213-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-182-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-181-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-180-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-179-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-178-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-177-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-192-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-191-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-175-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3132-316-0x0000000026FB0000-0x0000000026FBE000-memory.dmp
memory/3132-317-0x0000000029770000-0x000000002980C000-memory.dmp
memory/3132-323-0x0000000029CD0000-0x0000000029D36000-memory.dmp
memory/3132-324-0x000000002B350000-0x000000002B3E2000-memory.dmp
memory/3132-325-0x000000002B400000-0x000000002B9BA000-memory.dmp
memory/3132-330-0x000000002D090000-0x000000002D1F6000-memory.dmp
memory/3132-331-0x0000000026E60000-0x0000000026E6A000-memory.dmp
memory/3132-332-0x000000002CA60000-0x000000002CC22000-memory.dmp