Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
28/08/2026, 15:17
General
- Target 7024c376d00fbb19ea15f7e06d19d16de65c5b02283e072ae6c16f30dcebb3db.js
- Size 3.0MB
- Sample260828-spa48sdd94
- SHA256 7024c376d00fbb19ea15f7e06d19d16de65c5b02283e072ae6c16f30dcebb3db
Malware Config
Extracted
-
xworm
-
5.0
-
204.44.69.226:8824
-
DVsy1L2lFR4/2mFWh8EQ/w==:10
-
tSHCUvXm4ZmffmKQ
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Executes dropped EXE 2 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\7024c376d00fbb19ea15f7e06d19d16de65c5b02283e072ae6c16f30dcebb3db.js1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\PWVDHPKSOZXIFKUI.PIF"C:\Users\Admin\Documents\PWVDHPKSOZXIFKUI.PIF" C:\Users\Admin\Documents\PWVDHPKSOZXIFKUI.ttf2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\PWVDHPKSOZXIFKUI.PIF.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_6bca39517d21462ea98901dd180ec636.cs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9C80.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC226F1B00782E475981C61ABF38CE86A5.TMP"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\PWVDHPKSOZXIFKUI.PIF.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_5cb352c7f8de4c19b926a8ad0f73f7a0.cs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9CFD.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAFBDE2F28A5F4EA2808AB39C45466F1.TMP"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\PWVDHPKSOZXIFKUI.PIF.exe"C:\Users\Admin\AppData\Local\Temp\PWVDHPKSOZXIFKUI.PIF.exe" 32683⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
PWVDHPKSOZXIFKUI.PIF.exe
RES9C80.tmp
RES9CFD.tmp
PWVDHPKSOZXIFKUI.PIF
PWVDHPKSOZXIFKUI.ttf
CSCAFBDE2F28A5F4EA2808AB39C45466F1.TMP
guardian_src_6bca39517d21462ea98901dd180ec636.cs
memory/988-2462-0x00000000009C0000-0x00000000009C8000-memory.dmp
memory/3268-35-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-28-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-71-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-70-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-69-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-68-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-67-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-66-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-65-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-64-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-63-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-62-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-61-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-60-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-59-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-58-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-57-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-56-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-55-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-54-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-53-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-52-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-51-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-50-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-49-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-48-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-47-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-46-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-45-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-44-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-43-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-41-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-39-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-38-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-37-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-36-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-42-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-32-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-31-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-30-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-72-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-27-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-29-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-26-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-25-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-24-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-23-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-22-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-21-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-18-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-17-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-40-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-34-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-33-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-16-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-15-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-14-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-13-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-12-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-11-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-10-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-9-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-2427-0x0000000074C32000-0x0000000074C33000-memory.dmp
memory/3268-2428-0x0000000029B50000-0x0000000029B5E000-memory.dmp
memory/3268-2429-0x0000000029B90000-0x0000000029C2C000-memory.dmp
memory/3268-2430-0x0000000074C20000-0x00000000753DC000-memory.dmp
memory/3268-2431-0x0000000074C20000-0x00000000753DC000-memory.dmp
memory/3268-2433-0x0000000074C32000-0x0000000074C33000-memory.dmp
memory/3268-2434-0x0000000074C20000-0x00000000753DC000-memory.dmp
memory/3268-2435-0x0000000074C20000-0x00000000753DC000-memory.dmp
memory/3268-2436-0x000000002A0D0000-0x000000002A136000-memory.dmp
memory/3268-2438-0x0000000074C20000-0x00000000753DC000-memory.dmp
memory/3268-2439-0x000000002B9D0000-0x000000002BA62000-memory.dmp
memory/3268-2440-0x000000002BA80000-0x000000002C03A000-memory.dmp
memory/3268-2450-0x000000002F520000-0x000000002FF78000-memory.dmp
memory/3268-20-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-19-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3268-2448-0x000000002AFE0000-0x000000002AFE8000-memory.dmp
memory/3268-2446-0x000000002AF60000-0x000000002AFDC000-memory.dmp
memory/3268-2445-0x0000000034520000-0x000000003535C000-memory.dmp
memory/3268-2471-0x00000000026F0000-0x00000000028B2000-memory.dmp