Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
07/04/2026, 11:00
General
- Target z16PO_MARC_26O38965.bat.exe
- Size 771KB
- Sample260407-m4ehbad13p
- SHA256 da315d9c9c5c31c1cbfdcdbe673b94f236ad46afb6261ee7b22fea878b97a4e5
Malware Config
Extracted
-
xworm
-
178.16.52.78:7777
-
Install_directory
%AppData%
-
install_file
XWormClient.exe
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Drops startup file 3 IoCs
- SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\z16PO_MARC_26O38965.bat.exe"C:\Users\Admin\AppData\Local\Temp\z16PO_MARC_26O38965.bat.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\z16PO_MARC_26O38965.bat.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\z16PO_MARC_26O38965.bat.exe"C:\Users\Admin\AppData\Local\Temp\z16PO_MARC_26O38965.bat.exe"2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_h3q3na2u.34o.ps1
XWormClient.exe
memory/1108-48-0x00000000072E0000-0x0000000007314000-memory.dmp
memory/1108-34-0x0000000005AF0000-0x0000000005B56000-memory.dmp
memory/1108-56-0x0000000006710000-0x000000000672E000-memory.dmp
memory/1108-76-0x0000000005A80000-0x0000000005AC0000-memory.dmp
memory/1108-77-0x0000000005AD0000-0x0000000005ADA000-memory.dmp
memory/1108-78-0x0000000005F50000-0x0000000005F68000-memory.dmp
memory/1108-79-0x0000000006150000-0x000000000615A000-memory.dmp
memory/1108-57-0x0000000007330000-0x00000000073D4000-memory.dmp
memory/1108-75-0x0000000005380000-0x00000000053B7000-memory.dmp
memory/1108-74-0x00000000027B0000-0x0000000002814000-memory.dmp
memory/1108-71-0x00000000077B0000-0x00000000077B8000-memory.dmp
memory/1108-70-0x00000000077C0000-0x00000000077DA000-memory.dmp
memory/1108-69-0x00000000076C0000-0x00000000076D5000-memory.dmp
memory/1108-68-0x00000000076B0000-0x00000000076BE000-memory.dmp
memory/1108-67-0x0000000007680000-0x0000000007691000-memory.dmp
memory/1108-59-0x0000000007AB0000-0x000000000812A000-memory.dmp
memory/1108-35-0x0000000005B60000-0x0000000005BC6000-memory.dmp
memory/1108-33-0x0000000005A50000-0x0000000005A72000-memory.dmp
memory/1108-23-0x0000000002980000-0x0000000002990000-memory.dmp
memory/1108-37-0x0000000005BD0000-0x0000000005F27000-memory.dmp
memory/1108-38-0x0000000006100000-0x000000000611E000-memory.dmp
memory/1108-39-0x00000000061B0000-0x00000000061FC000-memory.dmp
memory/1108-66-0x0000000007700000-0x0000000007796000-memory.dmp
memory/1108-65-0x00000000074F0000-0x00000000074FA000-memory.dmp
memory/1108-60-0x0000000007470000-0x000000000748A000-memory.dmp
memory/1108-49-0x0000000071270000-0x00000000712BC000-memory.dmp
memory/1108-27-0x00000000053F0000-0x0000000005A1A000-memory.dmp
memory/1108-21-0x0000000002890000-0x00000000028C6000-memory.dmp
memory/1108-24-0x0000000002980000-0x0000000002990000-memory.dmp
memory/2680-80-0x00000000050E0000-0x0000000005144000-memory.dmp
memory/2680-20-0x0000000000400000-0x0000000000416000-memory.dmp
memory/2680-97-0x0000000005DC0000-0x0000000005DDE000-memory.dmp
memory/2680-64-0x0000000005560000-0x0000000005570000-memory.dmp
memory/2680-91-0x0000000005DC0000-0x0000000005DDE000-memory.dmp
memory/2680-86-0x0000000005560000-0x0000000005570000-memory.dmp
memory/2680-83-0x0000000005DC0000-0x0000000005DDE000-memory.dmp
memory/2680-82-0x0000000005D90000-0x0000000005DB1000-memory.dmp
memory/2680-81-0x00000000059B0000-0x00000000059C8000-memory.dmp
memory/2776-12-0x0000000005210000-0x00000000052B6000-memory.dmp
memory/2776-9-0x0000000004F10000-0x0000000004F20000-memory.dmp
memory/2776-6-0x0000000004F90000-0x0000000004FA6000-memory.dmp
memory/2776-5-0x0000000004FC0000-0x000000000505C000-memory.dmp
memory/2776-3-0x0000000004F10000-0x0000000004F20000-memory.dmp
memory/2776-2-0x0000000004D50000-0x0000000004DE2000-memory.dmp
memory/2776-1-0x0000000005300000-0x00000000058A6000-memory.dmp
memory/2776-0-0x0000000000010000-0x00000000000D6000-memory.dmp
memory/2776-8-0x0000000004B80000-0x0000000004BE4000-memory.dmp
memory/2776-7-0x0000000000C10000-0x0000000000CEF000-memory.dmp
memory/2776-4-0x0000000004CD0000-0x0000000004CDA000-memory.dmp
memory/2776-25-0x0000000000C10000-0x0000000000CEF000-memory.dmp
memory/2776-26-0x0000000004B80000-0x0000000004BE4000-memory.dmp
memory/3920-85-0x0000016E64560000-0x0000016E64572000-memory.dmp
memory/3920-84-0x0000016E62C10000-0x0000016E62C1C000-memory.dmp
memory/3920-46-0x0000016E645D0000-0x0000016E645F2000-memory.dmp
memory/3920-47-0x0000016E7CC20000-0x0000016E7CC66000-memory.dmp