Analysis
- max time kernel
149s - max time network
154s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/06/2026, 12:15
General
- Target Originalshippingdocuments02062026.exe
- Size 867KB
- Sample260602-pe115acy3z
- SHA256 5ae8e465fec781ce8eff14f2022c14b368c07dc215ec9272878896b984869fbd
Malware Config
Extracted
-
xworm
-
5.0
-
192.3.96.82:443
-
tF9fZyye78rDus07
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Originalshippingdocuments02062026.exe"C:\Users\Admin\AppData\Local\Temp\Originalshippingdocuments02062026.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Originalshippingdocuments02062026.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Originalshippingdocuments02062026.exe"C:\Users\Admin\AppData\Local\Temp\Originalshippingdocuments02062026.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\n3hhi11nmuw.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\RqmsSc.exe"C:\Users\Admin\AppData\Roaming\RqmsSc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RqmsSc.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\RqmsSc.exe"C:\Users\Admin\AppData\Roaming\RqmsSc.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
RqmsSc.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_x0wzw4ap.ubi.ps1
n3hhi11nmuw.ps1
RqmsSc.exe
memory/2404-61-0x00000000072A0000-0x00000000072BA000-memory.dmp
memory/2404-62-0x0000000007290000-0x0000000007298000-memory.dmp
memory/2404-60-0x00000000071A0000-0x00000000071B5000-memory.dmp
memory/2404-13-0x00000000023A0000-0x00000000023D6000-memory.dmp
memory/2404-14-0x0000000002460000-0x0000000002470000-memory.dmp
memory/2404-15-0x0000000002460000-0x0000000002470000-memory.dmp
memory/2404-59-0x0000000007190000-0x000000000719E000-memory.dmp
memory/2404-17-0x0000000004E80000-0x00000000054AA000-memory.dmp
memory/2404-19-0x0000000004D60000-0x0000000004D82000-memory.dmp
memory/2404-20-0x0000000004E10000-0x0000000004E76000-memory.dmp
memory/2404-21-0x00000000055B0000-0x0000000005616000-memory.dmp
memory/2404-58-0x0000000007160000-0x0000000007171000-memory.dmp
memory/2404-28-0x00000000056E0000-0x0000000005A37000-memory.dmp
memory/2404-29-0x0000000005C00000-0x0000000005C1E000-memory.dmp
memory/2404-30-0x0000000005D00000-0x0000000005D4C000-memory.dmp
memory/2404-57-0x00000000071E0000-0x0000000007276000-memory.dmp
memory/2404-56-0x0000000006FD0000-0x0000000006FDA000-memory.dmp
memory/2404-54-0x00000000075A0000-0x0000000007C1A000-memory.dmp
memory/2404-55-0x0000000006F50000-0x0000000006F6A000-memory.dmp
memory/2404-44-0x0000000006C10000-0x0000000006C44000-memory.dmp
memory/2404-45-0x0000000070870000-0x00000000708BC000-memory.dmp
memory/2404-52-0x0000000006BD0000-0x0000000006BEE000-memory.dmp
memory/2404-53-0x0000000006E50000-0x0000000006EF4000-memory.dmp
memory/2488-66-0x0000000005710000-0x0000000005720000-memory.dmp
memory/2488-39-0x0000000005710000-0x0000000005720000-memory.dmp
memory/2488-16-0x0000000000400000-0x000000000040E000-memory.dmp
memory/3940-90-0x0000000007B30000-0x0000000007B45000-memory.dmp
memory/3940-89-0x0000000007AF0000-0x0000000007B01000-memory.dmp
memory/3940-88-0x00000000077E0000-0x0000000007884000-memory.dmp
memory/3940-81-0x0000000070A60000-0x0000000070AAC000-memory.dmp
memory/3940-79-0x00000000065B0000-0x00000000065FC000-memory.dmp
memory/3940-76-0x0000000005FD0000-0x0000000006327000-memory.dmp
memory/4032-37-0x0000026F6DF30000-0x0000026F6DF52000-memory.dmp
memory/4820-6-0x0000000005D80000-0x0000000005D9E000-memory.dmp
memory/4820-2-0x0000000005740000-0x00000000057D2000-memory.dmp
memory/4820-3-0x0000000005890000-0x00000000058A0000-memory.dmp
memory/4820-7-0x0000000005890000-0x00000000058A0000-memory.dmp
memory/4820-1-0x0000000005DB0000-0x0000000006356000-memory.dmp
memory/4820-0-0x0000000000BD0000-0x0000000000CAE000-memory.dmp
memory/4820-8-0x0000000003130000-0x00000000031D2000-memory.dmp
memory/4820-4-0x0000000005800000-0x000000000580A000-memory.dmp
memory/4820-5-0x0000000005A30000-0x0000000005ACC000-memory.dmp