Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 13:33
General
- Target Transfer slip _Inv.no. 362098.JS.js
- Size 2.3MB
- Sample261102-qtmygstyct
- SHA256 5aeaedc4f48b365ef84a005e3b00f8a904c2ec2ae9c6e8cf0c226402da479b4c
Malware Config
Extracted
-
xworm
-
5.0
-
45.141.21.216:7007
-
oDT3nqq7KZxgUB6w
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Executes dropped EXE 2 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs
- Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 2 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Transfer slip _Inv.no. 362098.JS.js"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c echo. > "C:\Users\Admin\AppData\Local\Temp\Transfer slip _Inv.no. 362098.JS.js:Zone.Identifier"2⤵
- Executes a command shell one-liner
- NTFS ADS
-
-
C:\Users\Admin\Documents\YPLGBIQTHPGIEBXC.exe"C:\Users\Admin\Documents\YPLGBIQTHPGIEBXC.exe" C:\Users\Admin\Documents\CXBEIGPHTQIBGLPY2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\YPLGBIQTHPGIEBXC.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_c3be6be5d3734aa280d0842325a6a894.cs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES86E9.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD8346F2894C847BB9F39B13F33C2C70.TMP"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\YPLGBIQTHPGIEBXC.exe"C:\Users\Admin\AppData\Local\Temp\YPLGBIQTHPGIEBXC.exe" 47923⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2JavaScript
1Windows Command Shell
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
RES86E9.tmp
YPLGBIQTHPGIEBXC.exe
CXBEIGPHTQIBGLPY
YPLGBIQTHPGIEBXC.exe
CSCD8346F2894C847BB9F39B13F33C2C70.TMP
guardian_src_c3be6be5d3734aa280d0842325a6a894.cs
memory/4196-174-0x0000000000BD0000-0x0000000000BD8000-memory.dmp
memory/4792-34-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-29-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-16-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-14-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-12-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-13-0x0000000000950000-0x0000000000951000-memory.dmp
memory/4792-25-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-30-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-52-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-73-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-72-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-71-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-70-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-69-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-68-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-67-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-66-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-65-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-64-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-53-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-51-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-50-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-49-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-48-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-47-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-46-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-45-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-44-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-43-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-42-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-41-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-40-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-39-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-38-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-37-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-36-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-35-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-11-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-33-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-32-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-15-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-28-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-31-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-27-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-26-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-63-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-62-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-61-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-60-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-59-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-58-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-57-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-56-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-55-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-54-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-24-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-23-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-22-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-21-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-20-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-19-0x00000000009C0000-0x00000000009C1000-memory.dmp
memory/4792-18-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/4792-17-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-146-0x0000000074A32000-0x0000000074A33000-memory.dmp
memory/4792-147-0x0000000029950000-0x000000002995E000-memory.dmp
memory/4792-148-0x00000000299A0000-0x0000000029A3C000-memory.dmp
memory/4792-149-0x0000000074A20000-0x00000000751DC000-memory.dmp
memory/4792-150-0x0000000074A20000-0x00000000751DC000-memory.dmp
memory/4792-151-0x0000000074A20000-0x00000000751DC000-memory.dmp
memory/4792-152-0x0000000029ED0000-0x0000000029F36000-memory.dmp
memory/4792-153-0x0000000074A32000-0x0000000074A33000-memory.dmp
memory/4792-154-0x0000000074A20000-0x00000000751DC000-memory.dmp
memory/4792-156-0x0000000074A20000-0x00000000751DC000-memory.dmp
memory/4792-157-0x0000000074A20000-0x00000000751DC000-memory.dmp
memory/4792-158-0x000000002B370000-0x000000002B402000-memory.dmp
memory/4792-10-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4792-159-0x000000002B410000-0x000000002B9CA000-memory.dmp
memory/4792-160-0x0000000074A20000-0x00000000751DC000-memory.dmp
memory/4792-161-0x000000002BC60000-0x000000002BCDC000-memory.dmp
memory/4792-162-0x000000002BCF0000-0x000000002BCF8000-memory.dmp
memory/4792-175-0x000000002C5B0000-0x000000002C772000-memory.dmp