Analysis
- max time kernel
145s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
- submitted
09/08/2025, 17:42
General
- Target XWormClient.exe
- Size 33KB
- Sample250809-v97eaavl19
- SHA256 39fcfca241c6391afc7ad77aa3f2c62b3e49d7e59a5aff0ae845ede5836c933f
Score
10/10
Malware Config
Extracted
Family
-
xworm
Version
-
5.0
C2
-
arch.wsf-steel.com:31166
Mutex
-
kA0FgbjQ73THBtAk
Attributes
-
install_file
USB.exe
aes.plain
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWormClient.exe"C:\Users\Admin\AppData\Local\Temp\XWormClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4076-0-0x00000000007F0000-0x00000000007FE000-memory.dmp
memory/4076-1-0x000000001B670000-0x000000001B680000-memory.dmp
memory/4076-2-0x000000001B670000-0x000000001B680000-memory.dmp