Analysis
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
05/02/2026, 15:57
General
- Target 1e92c5d7ad812ca338b0e85bf1decfa613ecb31376cf21888d45f474a06921af.exe
- Size 840KB
- Sample260205-tea7xscv6c
- SHA256 1e92c5d7ad812ca338b0e85bf1decfa613ecb31376cf21888d45f474a06921af
Malware Config
Extracted
-
xworm
-
rency.ydns.eu:59013
-
wqo9.firewall-gateway.de:59013
-
code1.ydns.eu:59013
-
Install_directory
%AppData%
-
install_file
\WindowsSecurity\WindowsDefender.exe
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Drops startup file 2 IoCs
- Executes dropped EXE 3 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e92c5d7ad812ca338b0e85bf1decfa613ecb31376cf21888d45f474a06921af.exe"C:\Users\Admin\AppData\Local\Temp\1e92c5d7ad812ca338b0e85bf1decfa613ecb31376cf21888d45f474a06921af.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1e92c5d7ad812ca338b0e85bf1decfa613ecb31376cf21888d45f474a06921af.exe"C:\Users\Admin\AppData\Local\Temp\1e92c5d7ad812ca338b0e85bf1decfa613ecb31376cf21888d45f474a06921af.exe"2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\WindowsSecurity\WindowsDefender.exeC:\Users\Admin\AppData\Roaming\WindowsSecurity\WindowsDefender.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WindowsSecurity\WindowsDefender.exe"C:\Users\Admin\AppData\Roaming\WindowsSecurity\WindowsDefender.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\WindowsSecurity\WindowsDefender.exe"C:\Users\Admin\AppData\Roaming\WindowsSecurity\WindowsDefender.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
1e92c5d7ad812ca338b0e85bf1decfa613ecb31376cf21888d45f474a06921af.exe.log
WindowsDefender.exe
memory/220-1000-0x0000000006BD0000-0x0000000006BE6000-memory.dmp
memory/3960-505-0x0000000000400000-0x0000000000418000-memory.dmp
memory/3960-509-0x0000000005800000-0x0000000005810000-memory.dmp
memory/3960-1003-0x0000000005800000-0x0000000005810000-memory.dmp
memory/3960-1002-0x0000000006660000-0x00000000066C6000-memory.dmp
memory/5196-56-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-28-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-4-0x00000000057C0000-0x00000000057D0000-memory.dmp
memory/5196-5-0x0000000005460000-0x000000000546A000-memory.dmp
memory/5196-10-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-40-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-42-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-132-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-126-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-124-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-120-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-497-0x00000000057C0000-0x00000000057D0000-memory.dmp
memory/5196-496-0x0000000007470000-0x0000000007486000-memory.dmp
memory/5196-495-0x00000000073F0000-0x00000000073F1000-memory.dmp
memory/5196-46-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-116-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-108-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-106-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-104-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-102-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-98-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-96-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-94-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-92-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-88-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-86-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-82-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-78-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-76-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-498-0x0000000007540000-0x0000000007556000-memory.dmp
memory/5196-499-0x000000000A2D0000-0x000000000A2D6000-memory.dmp
memory/5196-72-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-66-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-64-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-60-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-1-0x0000000005A50000-0x0000000005FF6000-memory.dmp
memory/5196-52-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-48-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-118-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-3-0x0000000005540000-0x00000000055DC000-memory.dmp
memory/5196-128-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-36-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-34-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-30-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-44-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-24-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-22-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-20-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-130-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-122-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-113-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-114-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-110-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-100-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-90-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-84-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-80-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-74-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-70-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-68-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-62-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-58-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-54-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-50-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-38-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-32-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-26-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-18-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-16-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-14-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-12-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-2-0x00000000053C0000-0x0000000005452000-memory.dmp
memory/5196-0-0x0000000000850000-0x0000000000928000-memory.dmp
memory/5196-8-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-7-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/5196-6-0x0000000007240000-0x0000000007290000-memory.dmp
memory/5196-500-0x00000000057C0000-0x00000000057D0000-memory.dmp
memory/5196-501-0x00000000057C0000-0x00000000057D0000-memory.dmp