Analysis
- user interaction
yes - max time kernel
298s - max time network
293s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
14/04/2026, 02:52
General
- Target XClient.exe
- Size 30KB
- Sample260414-dct91set4w
- SHA256 d9c2646994d741962b8baadd890a2acb2fd1becb217cc0a6bc9f2155662c6915
Malware Config
Extracted
-
xworm
-
3.0
-
subscript-breadth.with.playit.plus:1073
-
CGjzT0CboUGQq8a3
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4736-0-0x00000000009E0000-0x00000000009EE000-memory.dmp
memory/4736-1-0x000000001B5F0000-0x000000001B600000-memory.dmp
memory/4736-2-0x0000000002B60000-0x0000000002B6C000-memory.dmp
memory/4736-3-0x000000001B5F0000-0x000000001B600000-memory.dmp
memory/4736-5-0x000000001BA00000-0x000000001BA6B000-memory.dmp
memory/4736-7-0x000000001BA00000-0x000000001BA6B000-memory.dmp
memory/4736-11-0x000000001BA00000-0x000000001BA6B000-memory.dmp
memory/4736-13-0x000000001BA00000-0x000000001BA6B000-memory.dmp
memory/4736-17-0x000000001BA00000-0x000000001BA6B000-memory.dmp
memory/4736-19-0x000000001BA00000-0x000000001BA6B000-memory.dmp
memory/4736-29-0x000000001BA00000-0x000000001BA6B000-memory.dmp
memory/4736-35-0x000000001BA00000-0x000000001BA6B000-memory.dmp
memory/4736-37-0x000000001BA00000-0x000000001BA6B000-memory.dmp
memory/4736-41-0x000000001BA00000-0x000000001BA6B000-memory.dmp
memory/4736-49-0x000000001BA00000-0x000000001BA6B000-memory.dmp
memory/4736-53-0x000000001BA00000-0x000000001BA6B000-memory.dmp
memory/4736-55-0x000000001BA00000-0x000000001BA6B000-memory.dmp