Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20251231-en - resource tags
- submitted
16/01/2026, 11:09
General
- Target 2026-01-16_d9cf7f79b1d401b44cb2d9ace835b552_cryptbot_icedid_luca-stealer_njrat_stealc.exe
- Size 1.7MB
- Sample260116-m9karaev7c
- SHA256 4c37e2e4e23dd8519773aab4b1adc8cdaba9090fbe7a88d7d7fe2eb1b94cf1e0
Malware Config
Extracted
-
xworm
-
sunsu.xyz:5442
-
SW79BtM+NxGaOgw72NuidA==:60
-
Install_directory
%Temp%
-
install_file
Onedrive.exe
Signatures
- Detect Xworm Payload 2 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Executes dropped EXE 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-01-16_d9cf7f79b1d401b44cb2d9ace835b552_cryptbot_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-01-16_d9cf7f79b1d401b44cb2d9ace835b552_cryptbot_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Onedrive.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Onedrive.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\njpass.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\njpass.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004E81⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
GeoIP.dat
Onedrive.exe
WinMM.Net.dll
njpass.exe
cam.dll
ch.dll
mic.dll
plg.dll
pw.dll
sc2.dll
memory/940-46-0x000000001CD20000-0x000000001CDC6000-memory.dmp
memory/940-52-0x000000001E850000-0x000000001E862000-memory.dmp
memory/940-50-0x000000001DB50000-0x000000001DB9C000-memory.dmp
memory/940-49-0x000000001CDD0000-0x000000001CDD8000-memory.dmp
memory/940-48-0x000000001D8F0000-0x000000001D98C000-memory.dmp
memory/940-47-0x000000001D320000-0x000000001D7EE000-memory.dmp
memory/2748-35-0x0000000001290000-0x00000000012A0000-memory.dmp
memory/2748-34-0x00000000008B0000-0x00000000008E2000-memory.dmp