Analysis
- max time kernel
149s - max time network
145s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
28/05/2026, 06:22
General
- Target b9fb571d043f535b6685675f65a157ee39d55a6111ec51ca404d54d5e4822cec.dll
- Size 417KB
- Sample260528-g5ea2sav3s
- SHA256 b9fb571d043f535b6685675f65a157ee39d55a6111ec51ca404d54d5e4822cec
Malware Config
Extracted
-
xworm
-
5.0
-
aiBot.casacam.net:8090
-
c5iFzH2kbVQHgQJn
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b9fb571d043f535b6685675f65a157ee39d55a6111ec51ca404d54d5e4822cec.dll,#11⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /TN "Xy0lgqoqczyleo" /TR \"C:\Users\Admin\AppData\Local\0lgqoqczyleo\0lgqoqczyleo.exe\" /SC ONLOGON /RL HIGHEST /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\0lgqoqczyleo\0lgqoqczyleo.exe"C:\Users\Admin\AppData\Local\0lgqoqczyleo\0lgqoqczyleo.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
0lgqoqczyleo.exe
dpnhupnp.dll
memory/1692-133-0x0000020838460000-0x0000020838470000-memory.dmp
memory/1692-2-0x00007FF86CB00000-0x00007FF86CE74000-memory.dmp
memory/1692-130-0x0000020838460000-0x0000020838470000-memory.dmp
memory/1692-132-0x000002081F800000-0x000002081F80E000-memory.dmp
memory/1692-131-0x00007FF862E90000-0x00007FF862EAD000-memory.dmp
memory/1692-134-0x0000020838460000-0x0000020838470000-memory.dmp
memory/1692-0-0x000002081DCC0000-0x000002081DCC1000-memory.dmp
memory/1692-124-0x000002081F700000-0x000002081F71E000-memory.dmp
memory/1692-2452-0x0000020838460000-0x0000020838470000-memory.dmp
memory/1692-2451-0x000002081DCC0000-0x000002081DCC1000-memory.dmp
memory/1692-3251-0x0000020838460000-0x0000020838470000-memory.dmp
memory/1692-3252-0x0000020838460000-0x0000020838470000-memory.dmp
memory/1692-4228-0x0000020838460000-0x0000020838470000-memory.dmp
memory/1692-1-0x00007FF86F240000-0x00007FF86F449000-memory.dmp
memory/1692-4604-0x0000020838460000-0x0000020838470000-memory.dmp