Overview

overview

10

Static

static

1

Puremode_bypass.rar

windows10-2004-x64

10

Puremode_bypass.rar

windows10-ltsc_2021-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    84s
  • max time network
    96s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    16/08/2026, 01:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Puremode_bypass.rar
  • Size 20.6MB
  • Sample260816-b7c8waxcrd
  • SHA256 401e540b56e343aeaa01a9a8f6276be71082e5bdb98b964d81c54f36fee66f21
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

  • xworm

C2

  • secretstorage.linkpc.net:9898

Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    chrome.exe

  • telegram

    https://api.telegram.org/bot8435435563:AAGViS0hRwe64hCSjIBcB6tivN2lPvPXXWA/sendMessage?chat_id=1469932389

Signatures

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Detect Xworm Payload 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Puremode_bypass.rar"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1220
    • C:\Users\Admin\AppData\Local\Temp\7zO4C4C0389\Puremode_bypass.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO4C4C0389\Puremode_bypass.exe"
      2⤵
        PID:4800
        • C:\Users\Admin\AppData\Local\Temp\chrome.exe
          "C:\Users\Admin\AppData\Local\Temp\chrome.exe"
          3⤵
            PID:1332
          • C:\Users\Admin\AppData\Local\Temp\pureLevelChanger.exe
            "C:\Users\Admin\AppData\Local\Temp\pureLevelChanger.exe"
            3⤵
              PID:952

        Network

              MITRE ATT&CK Matrix

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              Puremode_bypass.exe
              • Path C:\Users\Admin\AppData\Local\Temp\7zO4C4C0389\Puremode_bypass.exe
              • Size 13.8MB
              • SHA256 f5e77f4be6ec83a1845b0382286f04a77208020a38817ad75fad7c93b4c2d260
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Puremode_bypass.exe
              • Path C:\Users\Admin\AppData\Local\Temp\7zO4C4C0389\Puremode_bypass.exe
              • Size 12.2MB
              • SHA256 d5b1510dd506e8abbbef710def251f09d481402d41b089c0b87d5d1643cddbc7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Puremode_bypass.exe
              • Path C:\Users\Admin\AppData\Local\Temp\7zO4C4C0389\Puremode_bypass.exe
              • Size 15.7MB
              • SHA256 a13dc82f527225808ab439e35ab1613cc1b05bc6ee1df95cc5f4333d4e8d42af
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome.exe
              • Path C:\Users\Admin\AppData\Local\Temp\chrome.exe
              • Size 194KB
              • SHA256 33d8967bd1360074f79c1b880e7c7e5a0071fe368da1b3d30de2582dc99e430c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              pureLevelChanger.exe
              • Path C:\Users\Admin\AppData\Local\Temp\pureLevelChanger.exe
              • Size 7.2MB
              • SHA256 1cc4aa8baa12d9665df237143c901dd83eb88c69c358ba6a8954385dacd720b9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              pureLevelChanger.exe
              • Path C:\Users\Admin\AppData\Local\Temp\pureLevelChanger.exe
              • Size 6.8MB
              • SHA256 c99c6a2070eace41dfe82a1aea2c98b1f2500313397e9bdc4d7a2dfbcee7aa13
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              pureLevelChanger.exe
              • Path C:\Users\Admin\AppData\Local\Temp\pureLevelChanger.exe
              • Size 7.3MB
              • SHA256 e41efc3806d87e172cea9f9da7926e2919b461d8682f7c55152b646e4bdf0ebd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/952-45-0x00007FFCA78A0000-0x00007FFCA78A2000-memory.dmp
              Download

              memory/952-46-0x00007FF6C1100000-0x00007FF6C36DA000-memory.dmp
              Download

              memory/952-44-0x00007FFCA7890000-0x00007FFCA7892000-memory.dmp
              Download

              memory/1332-31-0x0000000000FF0000-0x0000000001026000-memory.dmp
              Download

              memory/4800-16-0x0000000003DE0000-0x0000000003DF0000-memory.dmp
              Download

              memory/4800-15-0x0000000000670000-0x0000000001B0A000-memory.dmp
              Download