Analysis
- max time kernel
101s - max time network
140s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
- submitted
17/06/2025, 09:22
General
- Target SecuriteInfo.com.Win32.MalwareX-gen.19961.13774.exe
- Size 495KB
- Sample250617-lccc7syscy
- SHA256 f8e5a47c68fac52c69ec3fd461cde2ff76d64fda08c528c066a0ab822485cd23
Malware Config
Extracted
-
xworm
-
79.141.160.131:8787
-
install_file
USB.exe
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of WriteProcessMemory 29 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.19961.13774.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.19961.13774.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.19961.13774.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uTdGFXKGgDF.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uTdGFXKGgDF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBDB2.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.19961.13774.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.19961.13774.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.19961.13774.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.19961.13774.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.19961.13774.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.19961.13774.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.19961.13774.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SecuriteInfo.com.Win32.MalwareX-gen.19961.13774.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
SecuriteInfo.com.Win32.MalwareX-gen.19961.13774.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_4ucjo1xy.n0q.ps1
tmpBDB2.tmp
memory/2068-22-0x0000000006020000-0x0000000006086000-memory.dmp
memory/2068-29-0x00000000744B0000-0x0000000074C61000-memory.dmp
memory/2068-42-0x0000000006190000-0x00000000064E7000-memory.dmp
memory/2068-65-0x0000000074D80000-0x0000000074DCC000-memory.dmp
memory/2068-78-0x0000000007D10000-0x0000000007D18000-memory.dmp
memory/2068-19-0x00000000744B0000-0x0000000074C61000-memory.dmp
memory/2068-85-0x00000000744B0000-0x0000000074C61000-memory.dmp
memory/3724-4-0x0000000005940000-0x000000000594A000-memory.dmp
memory/3724-5-0x00000000744B0000-0x0000000074C61000-memory.dmp
memory/3724-6-0x0000000005C00000-0x0000000005C9C000-memory.dmp
memory/3724-3-0x00000000059C0000-0x0000000005A52000-memory.dmp
memory/3724-2-0x0000000005F70000-0x0000000006516000-memory.dmp
memory/3724-46-0x00000000744B0000-0x0000000074C61000-memory.dmp
memory/3724-7-0x0000000005BC0000-0x0000000005BD4000-memory.dmp
memory/3724-10-0x00000000070B0000-0x0000000007106000-memory.dmp
memory/3724-9-0x00000000744B0000-0x0000000074C61000-memory.dmp
memory/3724-0-0x00000000744BE000-0x00000000744BF000-memory.dmp
memory/3724-8-0x00000000744BE000-0x00000000744BF000-memory.dmp
memory/3724-1-0x0000000000E20000-0x0000000000E9A000-memory.dmp
memory/4544-48-0x0000000005E00000-0x0000000005E4C000-memory.dmp
memory/4544-76-0x00000000072F0000-0x0000000007305000-memory.dmp
memory/4544-47-0x0000000005D60000-0x0000000005D7E000-memory.dmp
memory/4544-38-0x00000000744B0000-0x0000000074C61000-memory.dmp
memory/4544-50-0x0000000074D80000-0x0000000074DCC000-memory.dmp
memory/4544-59-0x0000000006CF0000-0x0000000006D0E000-memory.dmp
memory/4544-60-0x0000000006D60000-0x0000000006E04000-memory.dmp
memory/4544-49-0x0000000006D10000-0x0000000006D44000-memory.dmp
memory/4544-62-0x00000000070A0000-0x00000000070BA000-memory.dmp
memory/4544-61-0x00000000076E0000-0x0000000007D5A000-memory.dmp
memory/4544-63-0x0000000007120000-0x000000000712A000-memory.dmp
memory/4544-64-0x0000000007330000-0x00000000073C6000-memory.dmp
memory/4544-20-0x0000000004E90000-0x0000000004EB2000-memory.dmp
memory/4544-74-0x00000000072B0000-0x00000000072C1000-memory.dmp
memory/4544-75-0x00000000072E0000-0x00000000072EE000-memory.dmp
memory/4544-15-0x0000000002590000-0x00000000025C6000-memory.dmp
memory/4544-77-0x00000000073F0000-0x000000000740A000-memory.dmp
memory/4544-21-0x0000000005030000-0x0000000005096000-memory.dmp
memory/4544-84-0x00000000744B0000-0x0000000074C61000-memory.dmp
memory/4544-18-0x00000000744B0000-0x0000000074C61000-memory.dmp
memory/4544-16-0x00000000744B0000-0x0000000074C61000-memory.dmp
memory/4544-17-0x00000000050C0000-0x00000000056EA000-memory.dmp
memory/4924-86-0x0000000005F50000-0x00000000062A7000-memory.dmp
memory/4924-96-0x0000000006550000-0x000000000659C000-memory.dmp
memory/4924-97-0x000000006FB60000-0x000000006FBAC000-memory.dmp
memory/4924-106-0x0000000007790000-0x0000000007834000-memory.dmp
memory/4924-107-0x0000000007AA0000-0x0000000007AB1000-memory.dmp
memory/4924-108-0x0000000007AE0000-0x0000000007AF5000-memory.dmp
memory/5072-43-0x0000000000400000-0x0000000000412000-memory.dmp
memory/5164-110-0x0000000005930000-0x0000000005C87000-memory.dmp
memory/5164-120-0x000000006FB60000-0x000000006FBAC000-memory.dmp