Analysis
- user interaction
yes - max time kernel
898s - max time network
395s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
01/06/2026, 04:02
General
- Target AuraCheat.exe
- Size 105KB
- Sample260601-el1ntset4q
- SHA256 307987e4b58b058c6353f40f5116ed03ccafb44f561fd8ce1373f3844ed809a0
Score
10/10
Malware Config
Extracted
Family
-
xworm
Version
-
XWorm V5.6
Attributes
-
Install_directory
%Public%
-
install_file
Aura.exe
-
localhost
127.0.0.1
-
telegram
https://api.telegram.org/bot1234567890:ABCdefGHIjklMNOpqrsTUVwxyz-ABCdefGH
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AuraCheat.exe"C:\Users\Admin\AppData\Local\Temp\AuraCheat.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4736-0-0x00000000001C0000-0x00000000001E0000-memory.dmp
memory/4736-1-0x000000001AE10000-0x000000001AE20000-memory.dmp