Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
03/04/2026, 10:26
General
- Target xa4e810532996aee848e27a197a308df2d33a0d8f45fd2239a01a8c56b8501bda.exe
- Size 448KB
- Sample260403-mg13ssg121
- SHA256 a4e810532996aee848e27a197a308df2d33a0d8f45fd2239a01a8c56b8501bda
Score
10/10
Malware Config
Extracted
Family
-
xworm
Version
-
XWorm V6.5 by c3lestial.fun
C2
-
fpzmgxdblu.localto.net:8370
Attributes
-
install_file
USB.exe
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\xa4e810532996aee848e27a197a308df2d33a0d8f45fd2239a01a8c56b8501bda.exe"C:\Users\Admin\AppData\Local\Temp\xa4e810532996aee848e27a197a308df2d33a0d8f45fd2239a01a8c56b8501bda.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
specter_stager.log
memory/956-0-0x00000160796A0000-0x00000160796B0000-memory.dmp
memory/956-2-0x00000160796A0000-0x00000160796B0000-memory.dmp
memory/956-3-0x00000160796A0000-0x00000160796B0000-memory.dmp
memory/956-1-0x0000016078CA0000-0x0000016078CB2000-memory.dmp
memory/956-13-0x0000016078C80000-0x0000016078C94000-memory.dmp
memory/956-17-0x0000016078C70000-0x0000016078C7C000-memory.dmp
memory/956-18-0x00000160796A0000-0x00000160796B0000-memory.dmp
memory/956-20-0x00000160796A0000-0x00000160796B0000-memory.dmp
memory/956-19-0x00000160796A0000-0x00000160796B0000-memory.dmp