Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
07/08/2026, 10:15
General
- Target Reckless driver Cam8 photos.JS.js
- Size 2.2MB
- Sample260807-map2yswscv
- SHA256 ef69216d58bbdb5e87757a404ab392fb4fb243ce6fdc898bde7344fa9b24e2e8
Malware Config
Extracted
-
xworm
-
5.0
-
185.215.151.16:8823
-
Pb3089EP3WAwzicHHzF9zQ==:23
-
NWdhkNZjqJpGVQhC
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 3 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Reckless driver Cam8 photos.JS.js"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\HFAGWULSVUNNKSZS.PIF"C:\Users\Admin\Documents\HFAGWULSVUNNKSZS.PIF" C:\Users\Admin\Documents\HFAGWULSVUNNKSZS.ttf2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
HFAGWULSVUNNKSZS.PIF
HFAGWULSVUNNKSZS.ttf
memory/3508-7-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-8-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-13-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-12-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-18-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-17-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-16-0x00000000029D0000-0x00000000029D1000-memory.dmp
memory/3508-15-0x00000000029C0000-0x00000000029C1000-memory.dmp
memory/3508-14-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-11-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-10-0x00000000026D0000-0x00000000026D1000-memory.dmp
memory/3508-9-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-19-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-20-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-21-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-22-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-23-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-24-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-25-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-57-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-56-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-55-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-54-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-53-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-52-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-51-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-50-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-49-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-48-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-47-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-46-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-45-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-44-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-43-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-42-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-41-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-40-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-39-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-38-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-37-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-36-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-35-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-34-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-33-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-32-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-31-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-30-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-29-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-28-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-68-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-70-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-69-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-67-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-66-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-65-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-64-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-63-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-62-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-61-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-60-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-58-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-59-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-27-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-26-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3508-138-0x00000000299F0000-0x0000000029A00000-memory.dmp
memory/3508-139-0x0000000027080000-0x000000002708E000-memory.dmp
memory/3508-140-0x00000000299F0000-0x0000000029A00000-memory.dmp
memory/3508-141-0x00000000299F0000-0x0000000029A00000-memory.dmp
memory/3508-142-0x0000000029810000-0x00000000298AC000-memory.dmp
memory/3508-143-0x00000000299F0000-0x0000000029A00000-memory.dmp
memory/3508-145-0x00000000299F0000-0x0000000029A00000-memory.dmp
memory/3508-146-0x00000000299F0000-0x0000000029A00000-memory.dmp
memory/3508-148-0x00000000299F0000-0x0000000029A00000-memory.dmp
memory/3508-149-0x0000000029940000-0x00000000299A6000-memory.dmp
memory/3508-151-0x00000000299F0000-0x0000000029A00000-memory.dmp
memory/3508-153-0x000000002B1D0000-0x000000002B262000-memory.dmp
memory/3508-154-0x000000002B270000-0x000000002B814000-memory.dmp