Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20251231-en - resource tags
- submitted
23/01/2026, 17:51
General
- Target ee.exe
- Size 32KB
- Sample260123-wfg3zacy2e
- SHA256 b5122073b3704bcfc8f39e547c0e9c0f75e58b6ef83448ea7a32e1733d64d48c
Score
10/10
Malware Config
Extracted
Family
-
xworm
Version
-
5.0
C2
-
hL2k-32291.portmap.host:32291
Mutex
-
ZIAVX7fWkcI2lnYw
Attributes
-
install_file
USB.exe
aes.plain
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee.exe"C:\Users\Admin\AppData\Local\Temp\ee.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4760-0-0x0000000000970000-0x000000000097E000-memory.dmp
memory/4760-1-0x0000000002CB0000-0x0000000002CC0000-memory.dmp
memory/4760-2-0x0000000002CB0000-0x0000000002CC0000-memory.dmp