Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
21/04/2026, 08:01
General
- Target _346627d7d58703c3da5b604372778175219e5f7f8c0998f742ebede838fa79e4.exe
- Size 854KB
- Sample260421-jw22vsd16x
- SHA256 346627d7d58703c3da5b604372778175219e5f7f8c0998f742ebede838fa79e4
Malware Config
Extracted
-
xworm
-
209.99.188.19:8777
-
Install_directory
%AppData%
-
install_file
Windows32.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Drops startup file 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\_346627d7d58703c3da5b604372778175219e5f7f8c0998f742ebede838fa79e4.exe"C:\Users\Admin\AppData\Local\Temp\_346627d7d58703c3da5b604372778175219e5f7f8c0998f742ebede838fa79e4.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\_346627d7d58703c3da5b604372778175219e5f7f8c0998f742ebede838fa79e4.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\_346627d7d58703c3da5b604372778175219e5f7f8c0998f742ebede838fa79e4.exe"C:\Users\Admin\AppData\Local\Temp\_346627d7d58703c3da5b604372778175219e5f7f8c0998f742ebede838fa79e4.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\_346627d7d58703c3da5b604372778175219e5f7f8c0998f742ebede838fa79e4.exe"C:\Users\Admin\AppData\Local\Temp\_346627d7d58703c3da5b604372778175219e5f7f8c0998f742ebede838fa79e4.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\_346627d7d58703c3da5b604372778175219e5f7f8c0998f742ebede838fa79e4.exe"C:\Users\Admin\AppData\Local\Temp\_346627d7d58703c3da5b604372778175219e5f7f8c0998f742ebede838fa79e4.exe"2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
_346627d7d58703c3da5b604372778175219e5f7f8c0998f742ebede838fa79e4.exe.log
__PSScriptPolicyTest_a1pqrogj.ekx.ps1
Windows32.exe
memory/1052-19-0x00000000016D0000-0x00000000016E0000-memory.dmp
memory/1052-60-0x00000000081C0000-0x000000000883A000-memory.dmp
memory/1052-67-0x0000000007ED0000-0x0000000007EEA000-memory.dmp
memory/1052-66-0x0000000007DD0000-0x0000000007DE5000-memory.dmp
memory/1052-65-0x0000000007DC0000-0x0000000007DCE000-memory.dmp
memory/1052-64-0x0000000007D90000-0x0000000007DA1000-memory.dmp
memory/1052-63-0x0000000007E10000-0x0000000007EA6000-memory.dmp
memory/1052-62-0x0000000007C00000-0x0000000007C0A000-memory.dmp
memory/1052-61-0x0000000007B80000-0x0000000007B9A000-memory.dmp
memory/1052-58-0x0000000006D10000-0x0000000006D2E000-memory.dmp
memory/1052-20-0x00000000051C0000-0x00000000051F6000-memory.dmp
memory/1052-68-0x0000000007EC0000-0x0000000007EC8000-memory.dmp
memory/1052-71-0x0000000002E00000-0x0000000002E19000-memory.dmp
memory/1052-59-0x0000000007A50000-0x0000000007AF4000-memory.dmp
memory/1052-25-0x0000000005830000-0x0000000005E5A000-memory.dmp
memory/1052-26-0x0000000005F30000-0x0000000005F96000-memory.dmp
memory/1052-27-0x0000000005FA0000-0x0000000006006000-memory.dmp
memory/1052-72-0x0000000006550000-0x00000000065B4000-memory.dmp
memory/1052-33-0x00000000061D0000-0x0000000006527000-memory.dmp
memory/1052-35-0x0000000006750000-0x000000000676E000-memory.dmp
memory/1052-36-0x0000000006780000-0x00000000067CC000-memory.dmp
memory/1052-50-0x0000000006D40000-0x0000000006D74000-memory.dmp
memory/1052-51-0x0000000071DD0000-0x0000000071E1C000-memory.dmp
memory/1052-73-0x0000000007970000-0x0000000007A41000-memory.dmp
memory/3560-24-0x0000000005460000-0x00000000054C4000-memory.dmp
memory/3560-4-0x0000000005500000-0x0000000005522000-memory.dmp
memory/3560-1-0x0000000005530000-0x0000000005AD6000-memory.dmp
memory/3560-2-0x0000000005060000-0x00000000050F2000-memory.dmp
memory/3560-0-0x0000000000610000-0x00000000006EC000-memory.dmp
memory/3560-3-0x0000000005100000-0x0000000005457000-memory.dmp
memory/3560-12-0x0000000008690000-0x0000000008748000-memory.dmp
memory/3560-10-0x0000000005020000-0x0000000005030000-memory.dmp
memory/3560-9-0x0000000005460000-0x00000000054C4000-memory.dmp
memory/3560-8-0x0000000008640000-0x0000000008656000-memory.dmp
memory/3560-7-0x0000000005D20000-0x0000000005DBC000-memory.dmp
memory/3560-6-0x0000000005C20000-0x0000000005C2A000-memory.dmp
memory/3560-5-0x0000000005020000-0x0000000005030000-memory.dmp
memory/4196-80-0x000002A1E7F50000-0x000002A1E7F5C000-memory.dmp
memory/4196-81-0x000002A1E97B0000-0x000002A1E97B8000-memory.dmp
memory/4196-37-0x000002A1E9950000-0x000002A1E9972000-memory.dmp
memory/4196-44-0x000002A1EA280000-0x000002A1EA2C6000-memory.dmp
memory/4196-82-0x000002A1E97D0000-0x000002A1E97E2000-memory.dmp
memory/4684-74-0x0000000005920000-0x00000000059F1000-memory.dmp
memory/4684-49-0x00000000054C0000-0x00000000054D0000-memory.dmp
memory/4684-77-0x00000000060C0000-0x0000000006124000-memory.dmp
memory/4684-76-0x00000000054A0000-0x00000000054AE000-memory.dmp
memory/4684-21-0x0000000000400000-0x0000000000416000-memory.dmp
memory/4684-79-0x0000000006920000-0x000000000693E000-memory.dmp
memory/4684-75-0x0000000005270000-0x000000000527B000-memory.dmp
memory/4684-78-0x0000000006340000-0x0000000006361000-memory.dmp
memory/4684-83-0x00000000054C0000-0x00000000054D0000-memory.dmp
memory/4684-88-0x00000000060C0000-0x0000000006124000-memory.dmp
memory/4684-90-0x0000000006920000-0x000000000693E000-memory.dmp
memory/4684-99-0x0000000006920000-0x000000000693E000-memory.dmp
memory/4684-106-0x00000000060C0000-0x0000000006124000-memory.dmp
memory/4684-115-0x00000000060C0000-0x0000000006124000-memory.dmp
memory/4684-161-0x00000000060C0000-0x0000000006124000-memory.dmp