Resubmissions
15/09/2026, 11:12
260915-navswatygv1007/09/2026, 00:25
260907-aqql7sttav1004/08/2026, 14:58
260804-sb5rpashpf1004/08/2026, 06:06
260804-gt3t9seb381004/08/2026, 05:43
260804-gey8jaw1bx1024/07/2026, 07:14
260724-h2zy1svbmg1024/07/2026, 07:09
260724-hy9ztatwfy1024/07/2026, 06:50
260724-hmdggahn6v1021/07/2026, 16:13
260721-tpe9macc42321/07/2026, 16:00
260721-tfvb7axvcy10Analysis
- max time kernel
238s - max time network
241s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 14:58
Errors
General
- Target 4363463463464363463463463.exe
- Size 10KB
- Sample260804-sb5rpashpf
- SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
Malware Config
Extracted
-
remus_stealer
-
http://cofasl.shop:6590
-
http://myrtler.biz:9549
-
http://youngel.biz:8768
Extracted
-
phorphiex
-
http://178.16.54.109
Extracted
-
xworm
-
XWorm V5.6
-
147.185.221.25:63795
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
- Family: Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
- Family: Remus
Remus is a stealer written in C++.
- Family: RustMe Keylogger
RustMe is a keylogger written in C++.
- Family: SiriusRAT
SiriusRAT is a Windows RAT written in C++ with HVNC, offline keylogging, and remote desktop capabilities.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 2 IoCs
- Detects RustMe Keylogger 1 IoCs
- Detects SiriusRAT 1 IoCs
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- UAC bypass 3 TTPs 1 IoCs
- Disables RegEdit via registry modification 1 IoCs
- Downloads MZ/PE file 16 IoCs
- Executes dropped EXE 19 IoCs
- Loads dropped DLL 20 IoCs
- Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 2 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies WinLogon 2 TTPs 3 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 2 IoCs
- Detects Pyinstaller 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
- Delays execution with timeout.exe 1 IoCs
- Modifies Control Panel 4 IoCs
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies data under HKEY_USERS 13 IoCs
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 29 IoCs
- System policy modification 1 TTPs 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\Update.exe"C:\Users\Admin\AppData\Local\Temp\Files\Update.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\123123.exe"C:\Users\Admin\AppData\Local\Temp\Files\123123.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\IcarusLite-v1.1.13-win.exe"C:\Users\Admin\AppData\Local\Temp\Files\IcarusLite-v1.1.13-win.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\IcarusLite-v1.1.13-win.exe"C:\Users\Admin\AppData\Local\Temp\Files\IcarusLite-v1.1.13-win.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c title Icarus Lite4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\hilton.exe"C:\Users\Admin\AppData\Local\Temp\Files\hilton.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Trails.a3x3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe4⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\RustMe.exe"C:\Users\Admin\AppData\Local\Temp\Files\RustMe.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\NoEscape.exe"C:\Users\Admin\AppData\Local\Temp\Files\NoEscape.exe"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Modifies WinLogon
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- System policy modification
-
-
C:\Users\Admin\AppData\Local\Temp\Files\NanoCore_Portable.exe"C:\Users\Admin\AppData\Local\Temp\Files\NanoCore_Portable.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TempDel.bat" "3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mode.commode 30,204⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\timeout.exetimeout /nobreak 104⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\CoronaVirus.exe"C:\Users\Admin\AppData\Local\Temp\Files\CoronaVirus.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\mininewsplus-2.exe"C:\Users\Admin\AppData\Local\Temp\Files\mininewsplus-2.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\32.exe"C:\Users\Admin\AppData\Local\Temp\Files\32.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\setup.exe"C:\Users\Admin\AppData\Local\Temp\Files\setup.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Trojan.Malpack.Themida%20(Anti%20VM).exe"C:\Users\Admin\AppData\Local\Temp\Files\Trojan.Malpack.Themida%20(Anti%20VM).exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\JavaChecker.exe"C:\Users\Admin\AppData\Local\Temp\Files\JavaChecker.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\main1.exe"C:\Users\Admin\AppData\Local\Temp\Files\main1.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a32055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Winlogon Helper DLL
2Pre-OS Boot
1Bootkit
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Winlogon Helper DLL
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
6Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
123123.exe
32.exe
CFXBypass.exe
CoronaVirus.exe
IcarusLite-v1.1.13-win.exe
JavaChecker.exe
NanoCore_Portable.exe
NoEscape.exe
RustMe.exe
Trojan.Malpack.Themida%20(Anti%20VM).exe
Update.exe
XClient.exe
hilton.exe
main1.exe
mininewsplus-2.exe
setup.exe
AutoIt3.exe
Trails.a3x
flag_aq.png
flag_cx.png
flag_gp.png
flag_sj.png
TempDel.bat
VCRUNTIME140.dll
_bz2.pyd
_cffi_backend.cp310-win32.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
base_library.zip
cacert.pem
md.cp310-win32.pyd
md__mypyc.cp310-win32.pyd
_rust.pyd
_message.pyd
libcrypto-1_1.dll
libssl-1_1.dll
python3.dll
python310.dll
select.pyd
unicodedata.pyd
⢳ၜሥወ߭ᮉۈ⇾ٛᡶՂᦋ⭞ᷣ⨾ସἨⅶౕড়ᗮഖ࿎
memory/1196-155-0x000001CA114C0000-0x000001CA114F9000-memory.dmp
memory/1612-1373-0x0000000000400000-0x00000000004C9000-memory.dmp
memory/1612-985-0x0000000000400000-0x00000000004C9000-memory.dmp
memory/1760-25-0x00007FFA8F310000-0x00007FFA8FCB4000-memory.dmp
memory/1760-16-0x00007FFA8F310000-0x00007FFA8FCB4000-memory.dmp
memory/1760-86-0x00007FFA8F310000-0x00007FFA8FCB4000-memory.dmp
memory/1760-14-0x00007FFA8F49F000-0x00007FFA8F4A0000-memory.dmp
memory/1760-15-0x0000000000C30000-0x0000000000C52000-memory.dmp
memory/1760-51-0x00007FFA8F310000-0x00007FFA8FCB4000-memory.dmp
memory/1760-17-0x00007FFA8F310000-0x00007FFA8FCB4000-memory.dmp
memory/1760-18-0x00007FFA8F310000-0x00007FFA8FCB4000-memory.dmp
memory/1760-44-0x00007FFA8F310000-0x00007FFA8FCB4000-memory.dmp
memory/1760-42-0x00007FFA8F310000-0x00007FFA8FCB4000-memory.dmp
memory/2028-1001-0x0000000000360000-0x000000000037A000-memory.dmp
memory/3040-1-0x0000000000F70000-0x0000000000F78000-memory.dmp
memory/3040-1401-0x00000000747F0000-0x0000000074FAC000-memory.dmp
memory/3040-0-0x0000000074802000-0x0000000074803000-memory.dmp
memory/3040-3-0x00000000747F0000-0x0000000074FAC000-memory.dmp
memory/3040-127-0x0000000074802000-0x0000000074803000-memory.dmp
memory/3040-2-0x0000000005970000-0x0000000005A0C000-memory.dmp
memory/3040-129-0x00000000747F0000-0x0000000074FAC000-memory.dmp
memory/3412-210-0x0000000000400000-0x000000000056F000-memory.dmp
memory/3412-1399-0x0000000000400000-0x000000000056F000-memory.dmp
memory/3724-1384-0x0000000000D20000-0x00000000018E8000-memory.dmp
memory/3724-1382-0x0000000000D20000-0x00000000018E8000-memory.dmp
memory/3764-128-0x0000000065DC0000-0x0000000065E44000-memory.dmp
memory/3768-1261-0x0000000000400000-0x00000000005CC000-memory.dmp
memory/3768-1371-0x0000000000400000-0x00000000005CC000-memory.dmp
memory/3768-192-0x0000000000400000-0x00000000005CC000-memory.dmp
memory/5228-39-0x0000000000E10000-0x0000000000E20000-memory.dmp
memory/5228-43-0x0000000001780000-0x00000000017A2000-memory.dmp
memory/5440-152-0x00007FFAB2D20000-0x00007FFAB2F83000-memory.dmp
memory/5440-153-0x000001E289E60000-0x000001E289E61000-memory.dmp