Analysis
- user interaction
yes - max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
06/03/2026, 13:59
General
- Target 1123.exe
- Size 39KB
- Sample260306-raecnsfz3l
- SHA256 7053bff4339ab0055dfc613f57fda20d3e24cd67e082ea938f6505992a69deb4
Malware Config
Extracted
-
xworm
-
XWorm V6.5 by c3lestial.fun
-
fusldhtp5.localto.net:4437
-
gnTrLrkI0i8WKTKt
-
Install_directory
%Userprofile%
-
install_file
scvhost.exe
Signatures
- Detect Xworm Payload 2 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Drops startup file 2 IoCs
- Executes dropped EXE 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1123.exe"C:\Users\Admin\AppData\Local\Temp\1123.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1123.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '1123.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\scvhost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'scvhost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "scvhost" /tr "C:\Users\Admin\scvhost.exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\scvhost.exeC:\Users\Admin\scvhost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\scvhost.exeC:\Users\Admin\scvhost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\scvhost.exeC:\Users\Admin\scvhost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
scvhost.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_xpftaboe.vnb.ps1
scvhost.exe
memory/1616-21-0x00000184B96F0000-0x00000184B970C000-memory.dmp
memory/1616-32-0x00000184A1170000-0x00000184A1178000-memory.dmp
memory/1616-20-0x00000184B96C0000-0x00000184B96CA000-memory.dmp
memory/1616-9-0x00000184A1120000-0x00000184A1142000-memory.dmp
memory/1616-22-0x00000184B96D0000-0x00000184B96DA000-memory.dmp
memory/1616-23-0x00000184B9730000-0x00000184B974A000-memory.dmp
memory/1616-24-0x00000184B96E0000-0x00000184B96E8000-memory.dmp
memory/1616-25-0x00000184B9710000-0x00000184B9716000-memory.dmp
memory/1616-26-0x00000184B9720000-0x00000184B972A000-memory.dmp
memory/1616-27-0x00000184A0FD0000-0x00000184A0FE0000-memory.dmp
memory/1616-31-0x00000184A0EC0000-0x00000184A0ED2000-memory.dmp
memory/1616-19-0x00000184B9600000-0x00000184B96B3000-memory.dmp
memory/1616-30-0x000001849F670000-0x000001849F67C000-memory.dmp
memory/1616-18-0x00000184B95E0000-0x00000184B95FC000-memory.dmp
memory/1616-11-0x00007FF498FF0000-0x00007FF499000000-memory.dmp
memory/1616-1-0x00000184A0FD0000-0x00000184A0FE0000-memory.dmp
memory/1616-2-0x00000184A0FD0000-0x00000184A0FE0000-memory.dmp
memory/1616-10-0x00000184A0FD0000-0x00000184A0FE0000-memory.dmp
memory/1880-101-0x00000000008E0000-0x00000000008EC000-memory.dmp
memory/3216-95-0x000000001BAD0000-0x000000001BAE0000-memory.dmp
memory/3216-92-0x0000000002EB0000-0x0000000002EBC000-memory.dmp
memory/3216-0-0x0000000000DE0000-0x0000000000DF0000-memory.dmp
memory/3216-89-0x000000001BAD0000-0x000000001BAE0000-memory.dmp
memory/4492-94-0x0000000001450000-0x000000000145C000-memory.dmp
memory/4616-82-0x00000247D8450000-0x00000247D845C000-memory.dmp
memory/4616-83-0x00000247D8680000-0x00000247D8692000-memory.dmp
memory/4616-84-0x00000247F0AD0000-0x00000247F0AD8000-memory.dmp
memory/4740-111-0x00000000016B0000-0x00000000016BC000-memory.dmp
memory/4896-67-0x0000011631C20000-0x0000011631C28000-memory.dmp
memory/4896-66-0x0000011631910000-0x0000011631922000-memory.dmp
memory/4896-65-0x0000011619220000-0x000001161922C000-memory.dmp
memory/5044-50-0x00000183D0D10000-0x00000183D0D18000-memory.dmp
memory/5044-49-0x00000183B86A0000-0x00000183B86B2000-memory.dmp
memory/5044-48-0x00000183B8580000-0x00000183B858C000-memory.dmp