Analysis
- max time kernel
28s - max time network
15s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/04/2026, 10:21
General
- Target xMIC.exe
- Size 57KB
- Sample260415-md1ymaby3p
- SHA256 88766b00b80c8282be986de16c623ca4b3c84d4fbb1b1b22cf461ca96326258e
Malware Config
Extracted
-
xworm
-
Mh0-44853.portmap.host:44853
-
Install_directory
%AppData%
-
install_file
Myrralis.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Drops startup file 2 IoCs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\xMIC.exe"C:\Users\Admin\AppData\Local\Temp\xMIC.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\xMIC.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'xMIC.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Myrralis.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Myrralis.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Myrralis" /tr "C:\Users\Admin\AppData\Roaming\Myrralis.exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\Myrralis.exeC:\Users\Admin\AppData\Roaming\Myrralis.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_v32rbssm.luo.ps1
Myrralis.exe
memory/1180-98-0x000000001B120000-0x000000001B130000-memory.dmp
memory/1180-91-0x000000001B120000-0x000000001B130000-memory.dmp
memory/1180-87-0x000000001AE10000-0x000000001AEBF000-memory.dmp
memory/1180-86-0x0000000000950000-0x000000000095C000-memory.dmp
memory/1180-0-0x0000000000230000-0x0000000000244000-memory.dmp
memory/2132-65-0x0000027457EA0000-0x0000027457EAC000-memory.dmp
memory/2132-66-0x0000027459700000-0x00000274597AF000-memory.dmp
memory/2132-67-0x00000274598A0000-0x00000274598B2000-memory.dmp
memory/2948-84-0x000001E71C590000-0x000001E71C5A2000-memory.dmp
memory/2948-83-0x000001E71C460000-0x000001E71C50F000-memory.dmp
memory/2948-82-0x000001E71AC70000-0x000001E71AC7C000-memory.dmp
memory/3064-20-0x00000222A4B00000-0x00000222A4B0A000-memory.dmp
memory/3064-18-0x00000222A4C20000-0x00000222A4C3C000-memory.dmp
memory/3064-32-0x000002228C440000-0x000002228C452000-memory.dmp
memory/3064-30-0x000002228AB90000-0x000002228AB9C000-memory.dmp
memory/3064-27-0x00000222A4B10000-0x00000222A4B20000-memory.dmp
memory/3064-2-0x00000222A4B10000-0x00000222A4B20000-memory.dmp
memory/3064-1-0x00000222A4B10000-0x00000222A4B20000-memory.dmp
memory/3064-9-0x00000222A4A80000-0x00000222A4AA2000-memory.dmp
memory/3064-26-0x00000222A51B0000-0x00000222A51BA000-memory.dmp
memory/3064-25-0x00000222A51A0000-0x00000222A51A6000-memory.dmp
memory/3064-24-0x00000222A5070000-0x00000222A5078000-memory.dmp
memory/3064-23-0x00000222A51C0000-0x00000222A51DA000-memory.dmp
memory/3064-22-0x00000222A5060000-0x00000222A506A000-memory.dmp
memory/3064-21-0x00000222A5080000-0x00000222A509C000-memory.dmp
memory/3064-11-0x00007FF4B4960000-0x00007FF4B4970000-memory.dmp
memory/3064-19-0x00000222A4C40000-0x00000222A4CF3000-memory.dmp
memory/3064-31-0x000002228C5D0000-0x000002228C67F000-memory.dmp
memory/3064-10-0x00000222A4B10000-0x00000222A4B20000-memory.dmp
memory/4056-48-0x0000029ADA370000-0x0000029ADA37C000-memory.dmp
memory/4056-49-0x0000029AF4170000-0x0000029AF421F000-memory.dmp
memory/4056-50-0x0000029ADA3D0000-0x0000029ADA3E2000-memory.dmp
memory/4564-95-0x0000000002210000-0x000000000221C000-memory.dmp