Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
31/03/2026, 17:41
General
- Target SteamSetup.exe
- Size 325KB
- Sample260331-v9ts7afv9v
- SHA256 2ae4a3cc696a55e86eb17ad6b5fd6b415cfd3c62c94a966e140dea6a6ed6f119
Score
10/10
Malware Config
Extracted
Family
-
xworm
C2
-
81.159.116.2:7000
Attributes
-
Install_directory
%AppData%
-
install_file
SteamSetup.exe
-
localhost
127.0.0.1
Signatures
- Detect Xworm Payload 2 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Drops startup file 2 IoCs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SteamSetup.exe"C:\Users\Admin\AppData\Local\Temp\SteamSetup.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\SteamSetup.exeC:\Users\Admin\AppData\Roaming\SteamSetup.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
SteamSetup.exe
memory/2072-0-0x00000000008D0000-0x0000000000928000-memory.dmp
memory/2072-5-0x000000001B730000-0x000000001B740000-memory.dmp
memory/2072-10-0x0000000001130000-0x000000000113C000-memory.dmp
memory/2072-11-0x000000001B5A0000-0x000000001B68A000-memory.dmp
memory/2072-12-0x000000001B730000-0x000000001B740000-memory.dmp
memory/3948-9-0x0000000002FD0000-0x0000000002FDC000-memory.dmp