Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
22/05/2026, 02:54
General
- Target xa403cd8cc03aee693d587a568be64d717edf6c8c6d3e40f07199067c734153c1.exe
- Size 10.8MB
- Sample260522-ddv8psfy8x
- SHA256 a403cd8cc03aee693d587a568be64d717edf6c8c6d3e40f07199067c734153c1
Malware Config
Extracted
-
xworm
-
5.0
-
6.tcp.eu.ngrok.io:29843
-
n2a9kAFC9fPtli8N
-
Install_directory
%AppData%
-
install_file
svhost.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Drops startup file 1 IoCs
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of SetThreadContext 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\xa403cd8cc03aee693d587a568be64d717edf6c8c6d3e40f07199067c734153c1.exe"C:\Users\Admin\AppData\Local\Temp\xa403cd8cc03aee693d587a568be64d717edf6c8c6d3e40f07199067c734153c1.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'cvtres.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svhost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Updates\winupdate.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Updates\winupdate.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_aes4jsz0.pjr.ps1
cryptor_debug.log
cryptor_debug.log
cryptor_debug.log
cryptor_debug.log
winupdate.exe
svhost.exe
memory/1840-174-0x00000000703B0000-0x00000000703FC000-memory.dmp
memory/1860-157-0x00000000703B0000-0x00000000703FC000-memory.dmp
memory/1860-153-0x0000000005C70000-0x0000000005FC4000-memory.dmp
memory/2624-110-0x0000000005540000-0x0000000005B68000-memory.dmp
memory/2624-142-0x00000000078C0000-0x00000000078D4000-memory.dmp
memory/2624-122-0x0000000005F40000-0x0000000006294000-memory.dmp
memory/2624-123-0x0000000006350000-0x000000000636E000-memory.dmp
memory/2624-124-0x0000000006380000-0x00000000063CC000-memory.dmp
memory/2624-125-0x0000000006920000-0x0000000006952000-memory.dmp
memory/2624-126-0x00000000703B0000-0x00000000703FC000-memory.dmp
memory/2624-134-0x0000000007510000-0x000000000752E000-memory.dmp
memory/2624-135-0x0000000007540000-0x00000000075E3000-memory.dmp
memory/2624-136-0x0000000007CC0000-0x000000000833A000-memory.dmp
memory/2624-137-0x0000000007680000-0x000000000769A000-memory.dmp
memory/2624-138-0x00000000076F0000-0x00000000076FA000-memory.dmp
memory/2624-139-0x0000000007900000-0x0000000007996000-memory.dmp
memory/2624-140-0x0000000007880000-0x0000000007891000-memory.dmp
memory/2624-141-0x00000000078B0000-0x00000000078BE000-memory.dmp
memory/2624-113-0x0000000005C70000-0x0000000005CD6000-memory.dmp
memory/2624-143-0x00000000079C0000-0x00000000079DA000-memory.dmp
memory/2624-144-0x00000000079A0000-0x00000000079A8000-memory.dmp
memory/2624-114-0x0000000005D50000-0x0000000005DB6000-memory.dmp
memory/2624-111-0x0000000005390000-0x00000000053B2000-memory.dmp
memory/2624-66-0x0000000004F00000-0x0000000004F10000-memory.dmp
memory/2624-78-0x0000000004F00000-0x0000000004F10000-memory.dmp
memory/2624-67-0x0000000002A20000-0x0000000002A56000-memory.dmp
memory/2940-105-0x0000000000390000-0x00000000003A0000-memory.dmp
memory/3328-191-0x00000000703B0000-0x00000000703FC000-memory.dmp
memory/4296-52-0x0000000005890000-0x000000000592C000-memory.dmp
memory/4296-201-0x0000000005AF0000-0x0000000005B00000-memory.dmp
memory/4296-204-0x0000000006510000-0x000000000651A000-memory.dmp
memory/4296-203-0x0000000006520000-0x00000000065B2000-memory.dmp
memory/4296-202-0x0000000006640000-0x0000000006BE4000-memory.dmp
memory/4296-47-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4296-207-0x0000000005AF0000-0x0000000005B00000-memory.dmp