Analysis
- max time kernel
298s - max time network
291s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
10/05/2026, 15:28
General
- Target 16996-VR-26_004102_AH_032D2026.exe
- Size 699KB
- Sample260510-swee8sa13x
- SHA256 41d0a449e657da1473447ca21ed3dea47b3d311b7ebcd73413d62bb5e139748d
Malware Config
Extracted
-
xworm
-
5.0
-
204.10.160.250:7007
-
YaMXGbVWfOUMIxB5
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\16996-VR-26_004102_AH_032D2026.exe"C:\Users\Admin\AppData\Local\Temp\16996-VR-26_004102_AH_032D2026.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\16996-VR-26_004102_AH_032D2026.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\16996-VR-26_004102_AH_032D2026.exe"C:\Users\Admin\AppData\Local\Temp\16996-VR-26_004102_AH_032D2026.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\sjjm0wwp4vb.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\RoykkEjPXFZUj.exe"C:\Users\Admin\AppData\Roaming\RoykkEjPXFZUj.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RoykkEjPXFZUj.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\RoykkEjPXFZUj.exe"C:\Users\Admin\AppData\Roaming\RoykkEjPXFZUj.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
RoykkEjPXFZUj.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ws414whm.11m.ps1
sjjm0wwp4vb.ps1
RoykkEjPXFZUj.exe
memory/2384-4-0x0000000005520000-0x000000000552A000-memory.dmp
memory/2384-9-0x00000000057A0000-0x00000000057B0000-memory.dmp
memory/2384-7-0x0000000002D90000-0x0000000002DEF000-memory.dmp
memory/2384-8-0x00000000053F0000-0x0000000005409000-memory.dmp
memory/2384-10-0x0000000008690000-0x0000000008732000-memory.dmp
memory/2384-6-0x0000000005790000-0x00000000057A2000-memory.dmp
memory/2384-5-0x00000000057B0000-0x000000000584C000-memory.dmp
memory/2384-3-0x00000000057A0000-0x00000000057B0000-memory.dmp
memory/2384-24-0x00000000053F0000-0x0000000005409000-memory.dmp
memory/2384-23-0x0000000002D90000-0x0000000002DEF000-memory.dmp
memory/2384-2-0x0000000005470000-0x0000000005502000-memory.dmp
memory/2384-1-0x0000000005B60000-0x0000000006104000-memory.dmp
memory/2384-0-0x0000000000960000-0x0000000000A16000-memory.dmp
memory/2936-124-0x0000000000A30000-0x0000000000A49000-memory.dmp
memory/2936-125-0x0000000005460000-0x0000000005478000-memory.dmp
memory/2936-119-0x0000000006F10000-0x0000000006FB3000-memory.dmp
memory/2936-111-0x00000000710B0000-0x00000000710FC000-memory.dmp
memory/2936-110-0x00000000061F0000-0x000000000623C000-memory.dmp
memory/2936-108-0x00000000056E0000-0x0000000005A34000-memory.dmp
memory/2936-122-0x0000000007210000-0x0000000007224000-memory.dmp
memory/2936-121-0x00000000071D0000-0x00000000071E1000-memory.dmp
memory/2936-126-0x0000000005500000-0x000000000553C000-memory.dmp
memory/2936-127-0x0000000006E10000-0x0000000006E17000-memory.dmp
memory/2976-70-0x0000000006700000-0x0000000006712000-memory.dmp
memory/2976-99-0x000000000BBA0000-0x000000000BBAB000-memory.dmp
memory/2976-98-0x000000000BC00000-0x000000000BC1D000-memory.dmp
memory/2976-97-0x000000000BBE0000-0x000000000BBFB000-memory.dmp
memory/2976-86-0x00000000057B0000-0x00000000057C9000-memory.dmp
memory/2976-96-0x00000000057B0000-0x00000000057C9000-memory.dmp
memory/3048-27-0x0000000006040000-0x00000000060A6000-memory.dmp
memory/3048-62-0x0000000006F60000-0x0000000006F7A000-memory.dmp
memory/3048-69-0x0000000007DD0000-0x0000000007DE1000-memory.dmp
memory/3048-67-0x0000000006FF0000-0x0000000006FFA000-memory.dmp
memory/3048-71-0x0000000007E00000-0x0000000007E0E000-memory.dmp
memory/3048-72-0x0000000007E10000-0x0000000007E24000-memory.dmp
memory/3048-73-0x0000000007F10000-0x0000000007F2A000-memory.dmp
memory/3048-74-0x0000000007EF0000-0x0000000007EF8000-memory.dmp
memory/3048-22-0x00000000016D0000-0x00000000016E0000-memory.dmp
memory/3048-80-0x0000000005FE0000-0x0000000005FFE000-memory.dmp
memory/3048-83-0x0000000006E10000-0x0000000006E17000-memory.dmp
memory/3048-82-0x0000000006870000-0x000000000687A000-memory.dmp
memory/3048-79-0x0000000005930000-0x000000000594D000-memory.dmp
memory/3048-78-0x00000000016A0000-0x00000000016B9000-memory.dmp
memory/3048-81-0x0000000005FC0000-0x0000000005FCA000-memory.dmp
memory/3048-21-0x0000000005220000-0x0000000005256000-memory.dmp
memory/3048-25-0x0000000005990000-0x0000000005FB8000-memory.dmp
memory/3048-61-0x00000000082D0000-0x000000000894A000-memory.dmp
memory/3048-26-0x0000000005960000-0x0000000005982000-memory.dmp
memory/3048-68-0x0000000007E50000-0x0000000007EE6000-memory.dmp
memory/3048-59-0x0000000007BA0000-0x0000000007C43000-memory.dmp
memory/3048-58-0x0000000006DA0000-0x0000000006DBE000-memory.dmp
memory/3048-49-0x0000000006DC0000-0x0000000006DF2000-memory.dmp
memory/3048-50-0x0000000070CB0000-0x0000000070CFC000-memory.dmp
memory/3048-28-0x0000000006120000-0x0000000006186000-memory.dmp
memory/3048-36-0x0000000006250000-0x00000000065A4000-memory.dmp
memory/3048-38-0x0000000006920000-0x000000000696C000-memory.dmp
memory/3048-37-0x0000000006890000-0x00000000068AE000-memory.dmp
memory/3504-47-0x0000021744390000-0x00000217443B2000-memory.dmp
memory/3504-66-0x00000217440F0000-0x0000021744138000-memory.dmp
memory/4104-39-0x0000000005420000-0x0000000005430000-memory.dmp
memory/4104-90-0x00000000068C0000-0x00000000068E8000-memory.dmp
memory/4104-85-0x0000000005420000-0x0000000005430000-memory.dmp
memory/4104-84-0x00000000050D0000-0x00000000050E9000-memory.dmp
memory/4104-19-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4104-138-0x000000000DC30000-0x000000000EA94000-memory.dmp
memory/4104-141-0x000000000B590000-0x000000000B6F6000-memory.dmp
memory/4104-142-0x0000000007310000-0x000000000738A000-memory.dmp
memory/4104-143-0x0000000006920000-0x0000000006926000-memory.dmp
memory/4252-120-0x0000000001450000-0x0000000001469000-memory.dmp