Analysis
- max time kernel
298s - max time network
204s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
10/05/2026, 15:28
General
- Target 16996-VR-26_004102_AH_032D2026.exe
- Size 699KB
- Sample260510-swee8sa13x
- SHA256 41d0a449e657da1473447ca21ed3dea47b3d311b7ebcd73413d62bb5e139748d
Malware Config
Extracted
-
xworm
-
5.0
-
204.10.160.250:7007
-
YaMXGbVWfOUMIxB5
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\16996-VR-26_004102_AH_032D2026.exe"C:\Users\Admin\AppData\Local\Temp\16996-VR-26_004102_AH_032D2026.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\16996-VR-26_004102_AH_032D2026.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\16996-VR-26_004102_AH_032D2026.exe"C:\Users\Admin\AppData\Local\Temp\16996-VR-26_004102_AH_032D2026.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 17323⤵
- Program crash
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\pq0kgk0cxhu.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\RoykkEjPXFZUj.exe"C:\Users\Admin\AppData\Roaming\RoykkEjPXFZUj.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RoykkEjPXFZUj.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\RoykkEjPXFZUj.exe"C:\Users\Admin\AppData\Roaming\RoykkEjPXFZUj.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 17644⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3096 -ip 30961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 564 -ip 5641⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ncjirvdt.z4a.ps1
pq0kgk0cxhu.ps1
RoykkEjPXFZUj.exe
memory/564-114-0x0000000001220000-0x000000000122B000-memory.dmp
memory/564-113-0x0000000001420000-0x0000000001439000-memory.dmp
memory/564-115-0x0000000005B10000-0x0000000005BD1000-memory.dmp
memory/1516-92-0x000000000BE50000-0x000000000BE75000-memory.dmp
memory/1516-91-0x000000000BB80000-0x000000000BBC2000-memory.dmp
memory/1516-90-0x0000000005CC0000-0x0000000005CF7000-memory.dmp
memory/1516-82-0x0000000005890000-0x0000000005951000-memory.dmp
memory/1516-80-0x0000000005890000-0x0000000005951000-memory.dmp
memory/1516-81-0x0000000005CC0000-0x0000000005CF7000-memory.dmp
memory/1516-89-0x0000000005890000-0x0000000005951000-memory.dmp
memory/1628-112-0x0000000007360000-0x0000000007375000-memory.dmp
memory/1628-110-0x0000000007050000-0x00000000070F4000-memory.dmp
memory/1628-100-0x0000000005960000-0x0000000005CB7000-memory.dmp
memory/1628-118-0x0000000000B90000-0x0000000000BA9000-memory.dmp
memory/1628-102-0x00000000061F0000-0x000000000623C000-memory.dmp
memory/1628-117-0x0000000000B80000-0x0000000000B8B000-memory.dmp
memory/1628-103-0x0000000070E40000-0x0000000070E8C000-memory.dmp
memory/1628-111-0x0000000007310000-0x0000000007321000-memory.dmp
memory/1628-119-0x0000000004CA0000-0x0000000004D61000-memory.dmp
memory/1992-6-0x0000000005910000-0x0000000005922000-memory.dmp
memory/1992-3-0x00000000053D0000-0x00000000053E0000-memory.dmp
memory/1992-20-0x00000000011A0000-0x00000000011C2000-memory.dmp
memory/1992-4-0x00000000055F0000-0x00000000055FA000-memory.dmp
memory/1992-0-0x0000000000990000-0x0000000000A46000-memory.dmp
memory/1992-2-0x0000000005460000-0x00000000054F2000-memory.dmp
memory/1992-5-0x00000000056B0000-0x000000000574C000-memory.dmp
memory/1992-9-0x00000000085F0000-0x0000000008692000-memory.dmp
memory/1992-1-0x0000000005930000-0x0000000005ED6000-memory.dmp
memory/1992-8-0x00000000053D0000-0x00000000053E0000-memory.dmp
memory/1992-7-0x00000000011A0000-0x00000000011C2000-memory.dmp
memory/3096-16-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3096-65-0x0000000005590000-0x00000000055A8000-memory.dmp
memory/3096-64-0x0000000005DD0000-0x0000000005E91000-memory.dmp
memory/3096-41-0x0000000005580000-0x0000000005590000-memory.dmp
memory/4476-57-0x000002D4A4640000-0x000002D4A464C000-memory.dmp
memory/4476-58-0x000002D4A4A30000-0x000002D4A4A42000-memory.dmp
memory/4476-34-0x000002D4BCD30000-0x000002D4BCD52000-memory.dmp
memory/4892-24-0x0000000006260000-0x00000000062C6000-memory.dmp
memory/4892-69-0x0000000007F10000-0x0000000007F18000-memory.dmp
memory/4892-73-0x0000000002E90000-0x0000000002EA9000-memory.dmp
memory/4892-74-0x00000000056F0000-0x00000000057B1000-memory.dmp
memory/4892-79-0x0000000006850000-0x000000000685A000-memory.dmp
memory/4892-78-0x0000000006190000-0x00000000061A8000-memory.dmp
memory/4892-77-0x0000000006140000-0x000000000614A000-memory.dmp
memory/4892-76-0x0000000006680000-0x00000000066C0000-memory.dmp
memory/4892-75-0x0000000006640000-0x0000000006677000-memory.dmp
memory/4892-68-0x0000000007F20000-0x0000000007F3A000-memory.dmp
memory/4892-67-0x0000000007E20000-0x0000000007E35000-memory.dmp
memory/4892-66-0x0000000007E10000-0x0000000007E1E000-memory.dmp
memory/4892-63-0x0000000007DE0000-0x0000000007DF1000-memory.dmp
memory/4892-62-0x0000000007E60000-0x0000000007EF6000-memory.dmp
memory/4892-61-0x0000000007C50000-0x0000000007C5A000-memory.dmp
memory/4892-59-0x0000000008210000-0x000000000888A000-memory.dmp
memory/4892-60-0x0000000007BD0000-0x0000000007BEA000-memory.dmp
memory/4892-52-0x0000000007AB0000-0x0000000007B54000-memory.dmp
memory/4892-51-0x0000000006E60000-0x0000000006E7E000-memory.dmp
memory/4892-43-0x0000000006E80000-0x0000000006EB4000-memory.dmp
memory/4892-44-0x0000000070E50000-0x0000000070E9C000-memory.dmp
memory/4892-33-0x00000000068A0000-0x00000000068EC000-memory.dmp
memory/4892-32-0x0000000006870000-0x000000000688E000-memory.dmp
memory/4892-25-0x00000000062D0000-0x0000000006627000-memory.dmp
memory/4892-23-0x00000000061F0000-0x0000000006256000-memory.dmp
memory/4892-22-0x0000000006150000-0x0000000006172000-memory.dmp
memory/4892-21-0x00000000058C0000-0x0000000005EEA000-memory.dmp
memory/4892-18-0x0000000002ED0000-0x0000000002F06000-memory.dmp
memory/4892-19-0x0000000002F20000-0x0000000002F30000-memory.dmp