Analysis
- user interaction
yes - max time kernel
50s - max time network
49s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
19/02/2026, 03:13
General
- Target HESCOxCHEAT.exe
- Size 3.2MB
- Sample260219-dqr2taaz8a
- SHA256 b811b4498c04e2a34ddd6bdcdb0b11c61f530f83ef42bc589074f214b7af1ade
Malware Config
Extracted
-
xworm
-
5.0
-
next-dance.gl.at.ply.gg:15742
-
v1mtgouHNRcNxaTB
-
install_file
USB.exe
Signatures
- Detect Xworm Payload 2 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Executes dropped EXE 2 IoCs
- Drops file in Windows directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\HESCOxCHEAT.exe"C:\Users\Admin\AppData\Local\Temp\HESCOxCHEAT.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XWormClient.exe"C:\Users\Admin\AppData\Roaming\XWormClient.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\MARECHAL SYSTEM.exe"C:\Users\Admin\AppData\Roaming\MARECHAL SYSTEM.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MARECHAL SYSTEM.exe
XWormClient.exe
memory/604-22-0x0000000140000000-0x00000001402EE000-memory.dmp
memory/932-32-0x00000000031E0000-0x00000000031E7000-memory.dmp
memory/932-31-0x00000000015B0000-0x00000000016FD000-memory.dmp
memory/1580-23-0x000000001BD00000-0x000000001BDEA000-memory.dmp
memory/1580-0-0x0000000000E40000-0x0000000001180000-memory.dmp
memory/2764-34-0x000001DFA1E00000-0x000001DFA1EEA000-memory.dmp
memory/5092-12-0x00000000008F0000-0x00000000008FE000-memory.dmp
memory/5092-24-0x000000001B5F0000-0x000000001B600000-memory.dmp
memory/5092-25-0x000000001B5F0000-0x000000001B600000-memory.dmp
memory/5092-26-0x000000001BA00000-0x000000001BAEA000-memory.dmp
memory/5248-36-0x0000025375940000-0x0000025375A2A000-memory.dmp
memory/5256-35-0x00000194632B0000-0x000001946339A000-memory.dmp