Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
12/11/2026, 09:37
General
- Target FedEx AWB-Documents PDF.js
- Size 2.8MB
- Sample261112-llm63aec87
- SHA256 b5bcfe5af4011274e4885aff886350a9c6fc39be4c17cb0b33ce7d813cd7bc5d
Malware Config
Extracted
-
xworm
-
5.0
-
203.202.232.148:3131
-
O25649ioAZViQ6j9
-
install_file
USB.exe
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Detects DonutLoader 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
- Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\FedEx AWB-Documents PDF.js"1⤵
- Registers new Windows logon scripts automatically executed at logon.
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\QXBDVJYTFVBVJBXZ\QXBDVJYTFVBVJBXZ.exe"C:\ProgramData\QXBDVJYTFVBVJBXZ\QXBDVJYTFVBVJBXZ.exe" "C:\ProgramData\QXBDVJYTFVBVJBXZ\QXBDVJYTFVBVJBXZ.ini"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
QXBDVJYTFVBVJBXZ.exe
QXBDVJYTFVBVJBXZ.ini
QXBDVJYTFVBVJBXZ.zip
environment.ini
vcruntime140.dll
memory/4204-153-0x0000000073E02000-0x0000000073E03000-memory.dmp
memory/4204-157-0x0000000073DF0000-0x00000000745AC000-memory.dmp
memory/4204-63-0x00000000FF560000-0x00000000FF570000-memory.dmp
memory/4204-65-0x00000000FF560000-0x00000000FF570000-memory.dmp
memory/4204-88-0x00000000FF560000-0x00000000FF570000-memory.dmp
memory/4204-132-0x00000000FF560000-0x00000000FF570000-memory.dmp
memory/4204-112-0x00000000FF560000-0x00000000FF570000-memory.dmp
memory/4204-67-0x00000000FF560000-0x00000000FF570000-memory.dmp
memory/4204-66-0x0000000003680000-0x0000000003691000-memory.dmp
memory/4204-62-0x0000000000CA0000-0x0000000000CA1000-memory.dmp
memory/4204-154-0x0000000004700000-0x0000000004710000-memory.dmp
memory/4204-155-0x0000000007000000-0x000000000709C000-memory.dmp
memory/4204-156-0x0000000073DF0000-0x00000000745AC000-memory.dmp
memory/4204-64-0x00000000FF560000-0x00000000FF570000-memory.dmp
memory/4204-158-0x0000000007AF0000-0x00000000080AA000-memory.dmp
memory/4204-159-0x0000000073DF0000-0x00000000745AC000-memory.dmp
memory/4204-160-0x0000000009150000-0x00000000091E2000-memory.dmp
memory/4204-161-0x0000000009110000-0x000000000911A000-memory.dmp
memory/4204-162-0x0000000009260000-0x00000000092C6000-memory.dmp
memory/4204-164-0x0000000073DF0000-0x00000000745AC000-memory.dmp
memory/4204-163-0x0000000073E02000-0x0000000073E03000-memory.dmp
memory/4204-166-0x0000000073DF0000-0x00000000745AC000-memory.dmp
memory/4204-165-0x0000000066D80000-0x0000000066E09000-memory.dmp
memory/4204-167-0x0000000073DF0000-0x00000000745AC000-memory.dmp
memory/4204-168-0x0000000073DF0000-0x00000000745AC000-memory.dmp