Analysis
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
11/05/2026, 00:43
General
- Target 2026-05-11_3165dcd28c34cc94681b1f9116348c5b_cryptbot_glassworm_icedid_luca-stealer_njrat_stealc.exe
- Size 6.4MB
- Sample260511-a27d4ab16k
- SHA256 72dddda14e08a482dfbdb8eec3cf819404c64a63a62ca7cf5a7c1f0af3890ffe
Malware Config
Extracted
-
xworm
-
5.0
-
20.93.112.67:4782
-
Mgy56ULq9pKh5CKu
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 2 IoCs
- Custom signatureDetects Windows executables referencing non-Windows User-Agents 2 IoCs
- Custom signatureUPX dump on OEP (original entry point) 3 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 7 IoCs
- UPX packed file 12 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_3165dcd28c34cc94681b1f9116348c5b_cryptbot_glassworm_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_3165dcd28c34cc94681b1f9116348c5b_cryptbot_glassworm_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\x31.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\x31.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\jwptllhzcx.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jwptllhzcx.exeC:\Users\Admin\AppData\Local\Temp\jwptllhzcx.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_ctypes.pyd
_hashlib.pyd
__init__.pyc
__init__.pyc
_endian.pyc
__init__.pyc
aliases.pyc
cp1252.pyc
utf_8.pyc
__init__.pyc
_abc.pyc
libcrypto-1_1.dll
libffi-8.dll
library.dat
library.zip
__init__.pyc
_casefix.pyc
_compiler.pyc
_constants.pyc
_parser.pyc
nebula.dat
python311.dll
x31.exe
jwptllhzcx.exe
memory/3716-470-0x00000000008A0000-0x00000000008AE000-memory.dmp
memory/3716-471-0x00000000011C0000-0x00000000011CC000-memory.dmp
memory/4920-464-0x00007FFABD0B0000-0x00007FFABD0BE000-memory.dmp
memory/4920-460-0x00007FFABD0B0000-0x00007FFABD0BE000-memory.dmp
memory/4920-467-0x00007FFAA7AE0000-0x00007FFAA80C7000-memory.dmp
memory/4920-465-0x00007FF7AF990000-0x00007FF7AF99E000-memory.dmp
memory/4920-463-0x00007FFAA7760000-0x00007FFAA7AD5000-memory.dmp
memory/4920-431-0x00007FFAA7AE0000-0x00007FFAA80C7000-memory.dmp
memory/4920-450-0x00007FFAA7760000-0x00007FFAA7AD5000-memory.dmp
memory/4920-425-0x00007FF7AF990000-0x00007FF7AF99E000-memory.dmp