Analysis
- max time kernel
900s - max time network
440s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
11/10/2026, 12:11
General
- Target Openworld.exe
- Size 6.9MB
- Sample261011-pc5arsty3j
- SHA256 f9d76ea1f6070b8f736f4c85428c531d9b74557fc7b8422ee23db0788700c6ce
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Openworld.exe"C:\Users\Admin\AppData\Local\Temp\Openworld.exe"1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\.openworld\Openworld.exe"C:\Users\Admin\AppData\Roaming\.openworld\Openworld.exe" --silent1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Openworld.exe
openworld-launcher-12-windows-x64.zip
memory/1612-18-0x00007FF728B10000-0x00007FF7291FE000-memory.dmp
memory/5076-103-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-104-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-105-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-106-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-107-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-109-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-110-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-111-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-112-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-113-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-114-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-115-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-116-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-117-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-118-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-119-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-120-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-121-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-122-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-123-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-124-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-125-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-126-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-127-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-128-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-129-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-130-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-131-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-132-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-133-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-134-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-135-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-136-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-137-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-138-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-139-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-140-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-141-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-142-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-143-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-144-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-147-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-148-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-149-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-150-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-151-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-152-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-153-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-154-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-155-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-156-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-157-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-158-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-159-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-160-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-161-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-162-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-163-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-164-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-165-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-166-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-167-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp
memory/5076-168-0x00007FF7BDA70000-0x00007FF7BE15E000-memory.dmp