Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
03/05/2026, 17:09
General
- Target Velocity.exe
- Size 66KB
- Sample260503-vpcn6ses31
- SHA256 638df2ca2301358216da628a6482dd75b8c4cbdb356cb5a05b1ad0a99076ab96
Malware Config
Extracted
-
xworm
-
3.0
-
aferistin-41691.portmap.host:41691
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Drops startup file 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Velocity.exe"C:\Users\Admin\AppData\Local\Temp\Velocity.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Velocity.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Velocity.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Velocity.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_raucfvj1.2qe.ps1
memory/1764-77-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/1764-76-0x000000001BC70000-0x000000001BCDF000-memory.dmp
memory/1764-74-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/1764-69-0x0000000000AF0000-0x0000000000AFC000-memory.dmp
memory/1764-0-0x00000000002C0000-0x00000000002D6000-memory.dmp
memory/3308-49-0x000002E76C3E0000-0x000002E76C3F2000-memory.dmp
memory/3308-48-0x000002E753CC0000-0x000002E753CCC000-memory.dmp
memory/3308-50-0x000002E76C460000-0x000002E76C4CF000-memory.dmp
memory/5004-65-0x0000028FAC040000-0x0000028FAC04C000-memory.dmp
memory/5004-66-0x0000028FAC0E0000-0x0000028FAC0F2000-memory.dmp
memory/5004-67-0x0000028FC4750000-0x0000028FC47BF000-memory.dmp
memory/5872-19-0x0000024074A80000-0x0000024074B33000-memory.dmp
memory/5872-22-0x0000024074B50000-0x0000024074B5A000-memory.dmp
memory/5872-30-0x000002405C040000-0x000002405C04C000-memory.dmp
memory/5872-31-0x000002405C0E0000-0x000002405C0F2000-memory.dmp
memory/5872-32-0x0000024074780000-0x00000240747EF000-memory.dmp
memory/5872-26-0x0000024074BA0000-0x0000024074BAA000-memory.dmp
memory/5872-25-0x0000024074B90000-0x0000024074B96000-memory.dmp
memory/5872-24-0x0000024074B60000-0x0000024074B68000-memory.dmp
memory/5872-23-0x0000024074BB0000-0x0000024074BCA000-memory.dmp
memory/5872-27-0x000002405C100000-0x000002405C110000-memory.dmp
memory/5872-21-0x0000024074B70000-0x0000024074B8C000-memory.dmp
memory/5872-20-0x0000024074B40000-0x0000024074B4A000-memory.dmp
memory/5872-18-0x0000024074A60000-0x0000024074A7C000-memory.dmp
memory/5872-11-0x00007FF42DEE0000-0x00007FF42DEF0000-memory.dmp
memory/5872-9-0x0000024074750000-0x0000024074772000-memory.dmp
memory/5872-10-0x000002405C100000-0x000002405C110000-memory.dmp
memory/5872-2-0x000002405C100000-0x000002405C110000-memory.dmp
memory/5872-1-0x000002405C100000-0x000002405C110000-memory.dmp