Analysis
- max time kernel
149s - max time network
154s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
17/03/2026, 16:10
General
- Target 9e3fdb1daaa9146fa27e4f99d94f56be.exe
- Size 175KB
- Sample260317-tmp12shz2y
- SHA256 68795c47a9aeb9e3208ca814fcef157c8e5f73464298e5eec4bb0ea32831baba
Malware Config
Extracted
-
xworm
-
envio11.ddnsguru.com:4806
-
MYYiUJWob4L6dprO
-
install_file
USB.exe
Signatures
- Detect Xworm Payload 3 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e3fdb1daaa9146fa27e4f99d94f56be.exe"C:\Users\Admin\AppData\Local\Temp\9e3fdb1daaa9146fa27e4f99d94f56be.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1908-0-0x0000000000960000-0x0000000000993000-memory.dmp
memory/1908-1-0x0000000002D30000-0x0000000002D31000-memory.dmp
memory/1908-2-0x00000000057D0000-0x00000000057E0000-memory.dmp
memory/1908-3-0x0000000002ED0000-0x0000000002EDE000-memory.dmp
memory/1908-4-0x00000000057D0000-0x00000000057E0000-memory.dmp
memory/1908-5-0x00000000057E0000-0x000000000587C000-memory.dmp
memory/1908-6-0x00000000057D0000-0x00000000057E0000-memory.dmp
memory/1908-7-0x0000000000960000-0x0000000000993000-memory.dmp
memory/1908-8-0x0000000002D30000-0x0000000002D31000-memory.dmp
memory/1908-9-0x00000000057D0000-0x00000000057E0000-memory.dmp
memory/1908-10-0x00000000057D0000-0x00000000057E0000-memory.dmp
memory/1908-11-0x00000000057D0000-0x00000000057E0000-memory.dmp
memory/1908-12-0x0000000002EF0000-0x0000000002EF6000-memory.dmp
memory/1908-13-0x00000000057D0000-0x00000000057E0000-memory.dmp