Analysis
- max time kernel
150s - max time network
162s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
03/04/2026, 03:08
General
- Target d37c7d626bcff8c6213c0cc33949851edc5fc901c593f4e9718bb1fd8d191a55.exe
- Size 114KB
- Sample260403-dmzmgsct3s
- SHA256 d37c7d626bcff8c6213c0cc33949851edc5fc901c593f4e9718bb1fd8d191a55
Malware Config
Extracted
-
xworm
-
5.0
-
104.193.255.40:7070
-
lGCyIvkJc7VHBRUs
-
install_file
USB.exe
Signatures
- Detect Xworm Payload 2 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 1 IoCs
- Executes dropped EXE 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d37c7d626bcff8c6213c0cc33949851edc5fc901c593f4e9718bb1fd8d191a55.exe"C:\Users\Admin\AppData\Local\Temp\d37c7d626bcff8c6213c0cc33949851edc5fc901c593f4e9718bb1fd8d191a55.exe"1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\XWormClient.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_294d6d7e46284638a5e9830f0c5093cc.cs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCF51.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1F74148CACCF43E3B767EA18CE3CFDFA.TMP"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\XWormClient.exe"C:\Users\Admin\AppData\Local\Temp\XWormClient.exe" 12963⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RESCF51.tmp
XWormClient.exe
__PSScriptPolicyTest_1byzecn1.hqv.ps1
XWormClient.exe
CSC1F74148CACCF43E3B767EA18CE3CFDFA.TMP
guardian_src_294d6d7e46284638a5e9830f0c5093cc.cs
memory/1296-62-0x0000000000E50000-0x0000000000E5E000-memory.dmp
memory/1296-103-0x000000001D890000-0x000000001DDB8000-memory.dmp
memory/1296-102-0x000000001C8E0000-0x000000001C990000-memory.dmp
memory/1296-72-0x000000001CB50000-0x000000001CB8E000-memory.dmp
memory/1296-71-0x000000001C9E0000-0x000000001CB4C000-memory.dmp
memory/1296-64-0x000000001BA90000-0x000000001BB39000-memory.dmp
memory/1296-63-0x0000000001700000-0x000000000170C000-memory.dmp
memory/2448-0-0x000002F1D5CA0000-0x000002F1D5CB0000-memory.dmp
memory/2448-31-0x000002F1EE7A0000-0x000002F1EE7AA000-memory.dmp
memory/2448-39-0x000002F1EE130000-0x000002F1EE1D9000-memory.dmp
memory/2448-18-0x000002F1EE690000-0x000002F1EE745000-memory.dmp
memory/2448-20-0x000002F1EE770000-0x000002F1EE78C000-memory.dmp
memory/2448-38-0x000002F1EE110000-0x000002F1EE11C000-memory.dmp
memory/2448-35-0x000002F1D5CA0000-0x000002F1D5CB0000-memory.dmp
memory/2448-1-0x000002F1EE280000-0x000002F1EE2A2000-memory.dmp
memory/2448-30-0x000002F1EE790000-0x000002F1EE796000-memory.dmp
memory/2448-29-0x000002F1EE760000-0x000002F1EE768000-memory.dmp
memory/2448-28-0x000002F1EE7B0000-0x000002F1EE7CA000-memory.dmp
memory/2448-19-0x000002F1EE670000-0x000002F1EE67A000-memory.dmp
memory/2448-17-0x000002F1EE650000-0x000002F1EE66C000-memory.dmp
memory/2448-24-0x000002F1EE750000-0x000002F1EE75A000-memory.dmp
memory/2448-9-0x00007FF42B4C0000-0x00007FF42B4D0000-memory.dmp
memory/3916-82-0x000001EEC0920000-0x000001EEC092C000-memory.dmp
memory/4964-60-0x000001A1C0FB0000-0x000001A1C104B000-memory.dmp
memory/4964-61-0x000001A1C2DC0000-0x000001A1C2DCC000-memory.dmp
memory/5084-86-0x0000000000F30000-0x0000000000F38000-memory.dmp
memory/5804-79-0x00000225F9EB0000-0x00000225F9EBC000-memory.dmp