Analysis
- max time kernel
300s - max time network
301s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
19/02/2026, 01:42
General
- Target amhj.exe
- Size 39KB
- Sample260219-b4yqeahv8f
- SHA256 47ed5f61dda8dbf905f06588bfbc938ba95f86fbf072525140b025fea210556f
Malware Config
Extracted
-
xworm
-
5.0
-
Nexit-62461.portmap.host:62461
-
xIESsdaFhdraUmvt
-
Install_directory
%LocalAppData%
-
install_file
GeodeUpdater.exe
Signatures
- Detect Xworm Payload 2 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Drops startup file 2 IoCs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\amhj.exe"C:\Users\Admin\AppData\Local\Temp\amhj.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\amhj.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'amhj.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\GeodeUpdater.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'GeodeUpdater.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\GeodeUpdater.exeC:\Users\Admin\AppData\Local\GeodeUpdater.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
GeodeUpdater.exe
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_rt0bpatj.n3z.ps1
memory/900-94-0x000000001BA40000-0x000000001BA50000-memory.dmp
memory/900-93-0x0000000002F00000-0x0000000002F0C000-memory.dmp
memory/900-88-0x000000001BA40000-0x000000001BA50000-memory.dmp
memory/900-0-0x0000000000E30000-0x0000000000E40000-memory.dmp
memory/1184-83-0x000002ED77210000-0x000002ED77266000-memory.dmp
memory/1184-81-0x000002ED767D0000-0x000002ED767DC000-memory.dmp
memory/1184-82-0x000002ED76830000-0x000002ED76842000-memory.dmp
memory/3148-47-0x00000208BA850000-0x00000208BA85C000-memory.dmp
memory/3148-48-0x00000208BA970000-0x00000208BA982000-memory.dmp
memory/3148-49-0x00000208D30A0000-0x00000208D30F6000-memory.dmp
memory/4848-92-0x00000000013C0000-0x00000000013CC000-memory.dmp
memory/5520-31-0x00000245AA640000-0x00000245AA696000-memory.dmp
memory/5520-19-0x00000245AA630000-0x00000245AA63A000-memory.dmp
memory/5520-30-0x0000024591F60000-0x0000024591F72000-memory.dmp
memory/5520-26-0x0000024592130000-0x0000024592140000-memory.dmp
memory/5520-25-0x00000245AA6F0000-0x00000245AA6FA000-memory.dmp
memory/5520-24-0x00000245AA6E0000-0x00000245AA6E6000-memory.dmp
memory/5520-23-0x00000245AA6B0000-0x00000245AA6B8000-memory.dmp
memory/5520-22-0x00000245AA700000-0x00000245AA71A000-memory.dmp
memory/5520-1-0x0000024592130000-0x0000024592140000-memory.dmp
memory/5520-2-0x0000024592130000-0x0000024592140000-memory.dmp
memory/5520-3-0x00000245AA4E0000-0x00000245AA502000-memory.dmp
memory/5520-21-0x00000245AA6A0000-0x00000245AA6AA000-memory.dmp
memory/5520-20-0x00000245AA6C0000-0x00000245AA6DC000-memory.dmp
memory/5520-29-0x00000245905F0000-0x00000245905FC000-memory.dmp
memory/5520-18-0x00000245AA570000-0x00000245AA623000-memory.dmp
memory/5520-17-0x00000245AA550000-0x00000245AA56C000-memory.dmp
memory/5520-10-0x00007FF48A260000-0x00007FF48A270000-memory.dmp
memory/5712-65-0x00000232AD250000-0x00000232AD262000-memory.dmp
memory/5712-66-0x00000232AD8B0000-0x00000232AD906000-memory.dmp
memory/5712-64-0x0000023294BD0000-0x0000023294BDC000-memory.dmp