File name:

DETALLES CITACION JUDICIAL RADICADO No 20259969-9966569-99962366-9986.zip

Full analysis: https://app.any.run/tasks/3ebb297b-d902-4a57-a2b4-67984f638c26
Verdict: Malicious activity
Threats:

XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails.

Malware Trends Tracker     >>>
Analysis date: May 21, 2025, 14:49:33
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
remote
xworm
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

3EBA76F2A4F5375755F15A6F14C59C79

SHA1:

EBAFB211D3FD6753C13E3E7558F5D7DCF5E98B59

SHA256:

07005D9489E6771ACA9A58E6F5760CD513980FFEB04F909850C6CFD5F04DD2EF

SSDEEP:

98304:1f4VFV+M1WCaPitQuZ2fvhyDmWVfm9pyGLDPoYcduo1EZwFOTmn1vv9UoYc51qbK:7FjJTQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • 1Detalles diligencia judicial.exe (PID: 5164)
      • 1Detalles diligencia judicial.exe (PID: 2340)

    • XWORM has been detected (SURICATA)

      • AddInProcess32.exe (PID: 1052)

    • XWORM has been detected (YARA)

      • AddInProcess32.exe (PID: 1052)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 1Detalles diligencia judicial.exe (PID: 5164)
      • 1Detalles diligencia judicial.exe (PID: 2340)

    • Write to the desktop.ini file (may be used to cloak folders)

      • 1Detalles diligencia judicial.exe (PID: 5164)
      • 1Detalles diligencia judicial.exe (PID: 2340)

    • Contacting a server suspected of hosting an CnC

      • AddInProcess32.exe (PID: 1052)

    • Connects to unusual port

      • AddInProcess32.exe (PID: 1052)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 4880)

    • Starts CMD.EXE for commands execution

      • AddInProcess32.exe (PID: 1052)

    • Executing commands from a ".bat" file

      • AddInProcess32.exe (PID: 1052)

    • Deletes system .NET executable

      • cmd.exe (PID: 4880)

  • INFO

    • Reads the computer name

      • 1Detalles diligencia judicial.exe (PID: 5164)
      • AddInProcess32.exe (PID: 1052)
      • 1Detalles diligencia judicial.exe (PID: 2340)
      • AddInProcess32.exe (PID: 5256)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4996)

    • Manual execution by a user

      • 1Detalles diligencia judicial.exe (PID: 5164)
      • 1Detalles diligencia judicial.exe (PID: 2340)

    • Checks supported languages

      • 1Detalles diligencia judicial.exe (PID: 5164)
      • AddInProcess32.exe (PID: 1052)
      • 1Detalles diligencia judicial.exe (PID: 2340)
      • AddInProcess32.exe (PID: 5256)

    • Reads the machine GUID from the registry

      • AddInProcess32.exe (PID: 1052)
      • AddInProcess32.exe (PID: 5256)

    • Reads the software policy settings

      • slui.exe (PID: 5324)
      • slui.exe (PID: 1040)

    • Create files in a temporary directory

      • AddInProcess32.exe (PID: 1052)

    • Checks proxy server information

      • slui.exe (PID: 1040)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

XWorm

(PID) Process(1052) AddInProcess32.exe
C2medellin2029.duckdns.org:9999
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameXWorm V5.6
MutexyDoDxV7a3mkqemLt
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:05:15 07:16:38
ZipCRC: 0x8366e564
ZipCompressedSize: 36757
ZipUncompressedSize: 71616
ZipFileName: 1Detalles diligencia judicial.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
14
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe 1detalles diligencia judicial.exe conhost.exe no specs #XWORM addinprocess32.exe svchost.exe slui.exe 1detalles diligencia judicial.exe conhost.exe no specs addinprocess32.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
672\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1040C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1052"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
1Detalles diligencia judicial.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
AddInProcess.exe
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\addinprocess32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
XWorm
(PID) Process(1052) AddInProcess32.exe
C2medellin2029.duckdns.org:9999
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameXWorm V5.6
MutexyDoDxV7a3mkqemLt
1188timeout 3 C:\Windows\SysWOW64\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2340"C:\Users\admin\Desktop\1Detalles diligencia judicial.exe" C:\Users\admin\Desktop\1Detalles diligencia judicial.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\1detalles diligencia judicial.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\desktop\libhogweed-6.dll
c:\windows\system32\msvcrt.dll
c:\users\admin\desktop\libnettle-8.dll
c:\users\admin\desktop\libgmp-10.dll
c:\windows\system32\advapi32.dll
4008\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—1Detalles diligencia judicial.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4040\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—1Detalles diligencia judicial.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4812C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4880C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\tmp77F7.tmp.bat""C:\Windows\SysWOW64\cmd.exe—AddInProcess32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
3 118
Read events
3 097
Write events
21
Delete events
0

Modification events

(PID) Process:(4996) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4996) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4996) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4996) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\DETALLES CITACION JUDICIAL RADICADO No 20259969-9966569-99962366-9986.zip
(PID) Process:(4996) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4996) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4996) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4996) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4996) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(4996) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
Executable files
12
Suspicious files
2
Text files
27
Unknown types
0

Dropped files

PID
Process
Filename
Type
4996WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4996.29853\1Detalles diligencia judicial.exeexecutable
MD5:58808F935757EBA1F437A7B2FBBA1866
SHA256:6627F3063CD057C302CA6CBAC406BFAF3BE1CF8A6E262B55B5AE646407BC9FD9
4996WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4996.29853\libgmp-10.dllexecutable
MD5:FEEE463B865C1A0E734B1B910A00FE2E
SHA256:EBD969D6A3F9D28C7D9280DEF33D109DFB65E903F7913B69530461BFAE9B05D7
51641Detalles diligencia judicial.exeC:\Users\admin\SystemRootDoc\libgmp-10.dllexecutable
MD5:FEEE463B865C1A0E734B1B910A00FE2E
SHA256:EBD969D6A3F9D28C7D9280DEF33D109DFB65E903F7913B69530461BFAE9B05D7
51641Detalles diligencia judicial.exeC:\Users\admin\SystemRootDoc\DETALLES CITACION JUDICIAL RADICADO No 20259969-9966569-99962366-9986.zipcompressed
MD5:3EBA76F2A4F5375755F15A6F14C59C79
SHA256:07005D9489E6771ACA9A58E6F5760CD513980FFEB04F909850C6CFD5F04DD2EF
4996WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4996.29853\libhogweed-6.dllexecutable
MD5:A73E27000A5489C636BF1D7C69538684
SHA256:4F13CDF02BFFEE3486DDDD9A42065BF3FE9C071AE17528029C8B92A8989ECE34
51641Detalles diligencia judicial.exeC:\Users\admin\SystemRootDoc\advertisegames.jpgimage
MD5:20203BE8D42D7AD7F2AA65DFBDA12F05
SHA256:F6AC99577816E2042F9232F9B7002D0758261E7D217836F176902792C404A08A
4996WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4996.29853\libnettle-8.dllexecutable
MD5:0CA82757B30327EBAB59B300A4662AFA
SHA256:9864B9637E1F73FEC9DDC43DA78D20ACB7AF114F44DDC66077EAB75BB6298641
51641Detalles diligencia judicial.exeC:\Users\admin\SystemRootDoc\desktop.initext
MD5:9E36CC3537EE9EE1E3B10FA4E761045B
SHA256:4B9D687AC625690FD026ED4B236DAD1CAC90EF69E7AD256CC42766A065B50026
51641Detalles diligencia judicial.exeC:\Users\admin\SystemRootDoc\libnettle-8.dllexecutable
MD5:0CA82757B30327EBAB59B300A4662AFA
SHA256:9864B9637E1F73FEC9DDC43DA78D20ACB7AF114F44DDC66077EAB75BB6298641
51641Detalles diligencia judicial.exeC:\Users\admin\SystemRootDoc\coastdie.jpgimage
MD5:9EAFB17683F0B7B3B316813B38C24599
SHA256:ED6A1F0E57E06BAEA0CFC20EB660DA0A81CD66F475F6EA089FBFC054593899E0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
23
DNS requests
17
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7052
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7052
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6544
svchost.exe
20.190.159.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1052
AddInProcess32.exe
46.246.6.2:9999
medellin2029.duckdns.org
GleSYS AB
SE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
google.com
  • 142.250.185.174
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.71
  • 40.126.31.131
  • 40.126.31.73
  • 40.126.31.3
  • 20.190.159.131
  • 40.126.31.128
  • 20.190.159.4
  • 20.190.159.130
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
medellin2029.duckdns.org
  • 46.246.6.2
unknown
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
2196
svchost.exe
Misc activity
ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
1052
AddInProcess32.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Xworm TCP Packet
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DETALLES CITACION JUDICIAL RADICADO No 20259969-9966569-99962366-9986.zip