7f7c2ed7a2fd6163a6004386287033bcaca83d7332fd592e4291c8a89252ea5a

Analysis

user interaction
yes
max time kernel
45s
max time network
41s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 11:20

Target
XWorm V3.0.rar
Size 23.9MB
Sample260831-nfd3bas1ew
SHA256 7f7c2ed7a2fd6163a6004386287033bcaca83d7332fd592e4291c8a89252ea5a
MD5 f38e858f5ee1fd28cff7d67aa5bcd91c
SHA1 0cd4d698e0d96892f2840edc3edb84327cc25d22
SHA512 7c8556b361d4f69601892317d0a070e0d374f1b6d554f7e1ed7bb669b5eccdb55e2665d5460998909b7cece4c660b9f75231080b312ce9c753880122765874b7
SSDEEP 393216:edY1Ze39n+LWKFa0zoSVV8f2aG2aIKKBfg9LXbBBn4QCV1jyjDVkOQ08T:edY63wfamVV8fpGNIKKBfUTbBBeVByfI
TLSH
T1144733C6B2A853980C56B8ECFBC3C5D9CF442BA2045D7138A621C5927D6DB80F7E5F89
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/files/0x000a00000002412f-4.dat	net_reactor

Executes dropped EXE 2 IoCs

pid	Process
2816	XWorm V3.0.exe
3432	XWorm V3.0.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4728	7zFM.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of FindShellTrayWindow 3 IoCs

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 2816	4728	7zFM.exe	86
PID 4728 wrote to memory of 3432	4728	7zFM.exe	88

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\XWorm V3.0.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Users\Admin\AppData\Local\Temp\7zO87274A28\XWorm V3.0.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO87274A28\XWorm V3.0.exe"
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Users\Admin\AppData\Local\Temp\7zO8727FF28\XWorm V3.0.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO8727FF28\XWorm V3.0.exe"
  2⤵
  - Executes dropped EXE
  PID:3432

XWorm V3.0.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO87274A28\XWorm V3.0.exe
Size 7.1MB
SHA256 d1b0cb76d6ff1e54e5669cc3ba76ba6224be19e721cc61a9e223a596a9bb332f
MD5 71b0bb52ae4137c3e40dc802711e2acc
SHA1 e154869a5725806c2b12866479be8cf326d52116
SHA512 eea4513a347d9b2a5ee700388c34d9677869702384128b57e3299cff277b585fd713f4b44830c79da2b74ecc138d99c8aec9b4757d9dda6d3fa475a1dfdb6588
SSDEEP 196608:rJNE1b0RkLZvaU6ScXc4sqgCzlMNxKa+M9:rJt4vKSoiqgASNUP
TLSH
T11E76F1053F90DB0DD02A3E7284E4D03047F2FDEA5A61D60B7BD52FDBF912296A887259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2816-24-0x0000020344AD0000-0x00000203451FA000-memory.dmp

Download

memory/2816-25-0x0000020360B40000-0x0000020361656000-memory.dmp

Download