Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
03/04/2026, 03:08
General
- Target d37c7d626bcff8c6213c0cc33949851edc5fc901c593f4e9718bb1fd8d191a55.exe
- Size 114KB
- Sample260403-dmzmgsct3s
- SHA256 d37c7d626bcff8c6213c0cc33949851edc5fc901c593f4e9718bb1fd8d191a55
Malware Config
Extracted
-
xworm
-
5.0
-
104.193.255.40:7070
-
lGCyIvkJc7VHBRUs
-
install_file
USB.exe
Signatures
- Detect Xworm Payload 2 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Drops startup file 1 IoCs
- Executes dropped EXE 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d37c7d626bcff8c6213c0cc33949851edc5fc901c593f4e9718bb1fd8d191a55.exe"C:\Users\Admin\AppData\Local\Temp\d37c7d626bcff8c6213c0cc33949851edc5fc901c593f4e9718bb1fd8d191a55.exe"1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_rvidp4cy.0nt.ps1
XWormClient.exe
memory/2404-70-0x000000001B8F0000-0x000000001B95F000-memory.dmp
memory/2404-76-0x000000001B8F0000-0x000000001B95F000-memory.dmp
memory/2404-73-0x000000001B8F0000-0x000000001B95F000-memory.dmp
memory/2404-71-0x000000001B8F0000-0x000000001B95F000-memory.dmp
memory/2404-77-0x000000001B8F0000-0x000000001B95F000-memory.dmp
memory/2404-69-0x000000001B8F0000-0x000000001B95F000-memory.dmp
memory/2404-68-0x000000001B8F0000-0x000000001B95F000-memory.dmp
memory/2404-67-0x000000001B7C0000-0x000000001B7C6000-memory.dmp
memory/2404-66-0x000000001C530000-0x000000001C57E000-memory.dmp
memory/2404-64-0x000000001B8F0000-0x000000001B95F000-memory.dmp
memory/2404-63-0x0000000000B90000-0x0000000000B9E000-memory.dmp
memory/5220-18-0x00000141EA7A0000-0x00000141EA853000-memory.dmp
memory/5220-23-0x00000141EA710000-0x00000141EA71A000-memory.dmp
memory/5220-34-0x00000141D2080000-0x00000141D2090000-memory.dmp
memory/5220-37-0x00000141D2140000-0x00000141D2152000-memory.dmp
memory/5220-38-0x00000141EA3E0000-0x00000141EA44F000-memory.dmp
memory/5220-29-0x00000141EA750000-0x00000141EA756000-memory.dmp
memory/5220-0-0x00000141D2080000-0x00000141D2090000-memory.dmp
memory/5220-28-0x00000141EA720000-0x00000141EA728000-memory.dmp
memory/5220-27-0x00000141EA770000-0x00000141EA78A000-memory.dmp
memory/5220-30-0x00000141EA760000-0x00000141EA76A000-memory.dmp
memory/5220-20-0x00000141EA730000-0x00000141EA74C000-memory.dmp
memory/5220-19-0x00000141EA700000-0x00000141EA70A000-memory.dmp
memory/5220-1-0x00000141D2080000-0x00000141D2090000-memory.dmp
memory/5220-17-0x00000141EA6E0000-0x00000141EA6FC000-memory.dmp
memory/5220-10-0x00007FF465CE0000-0x00007FF465CF0000-memory.dmp
memory/5220-9-0x00000141D2080000-0x00000141D2090000-memory.dmp
memory/5220-2-0x00000141EA3B0000-0x00000141EA3D2000-memory.dmp
memory/5360-62-0x000002C976660000-0x000002C9766CF000-memory.dmp