Analysis
- user interaction
yes - max time kernel
76s - max time network
65s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
02/06/2026, 12:25
General
- Target Xworm5.6Fixed/XWorm.exe
- Size 12.9MB
- Sample260602-plk89ac191
- SHA256 98933e3c458127d27129c03549f7e0b25f1bc46c8ff42763fd02b29bfc2ac331
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 27 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xworm5.6Fixed\XWorm.exe"C:\Users\Admin\AppData\Local\Temp\Xworm5.6Fixed\XWorm.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x434 0x3cc1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3836-0-0x000001B2F1BA0000-0x000001B2F2890000-memory.dmp
memory/3836-1-0x000001B2F4EB0000-0x000001B2F4EC0000-memory.dmp
memory/3836-2-0x000001B2F5AC0000-0x000001B2F5CB4000-memory.dmp
memory/3836-3-0x000001B2F4EB0000-0x000001B2F4EC0000-memory.dmp
memory/3836-4-0x000001B2F4EB0000-0x000001B2F4EC0000-memory.dmp
memory/3836-5-0x000001B2F4EB0000-0x000001B2F4EC0000-memory.dmp
memory/3836-6-0x000001B2F4EB0000-0x000001B2F4EC0000-memory.dmp
memory/3836-7-0x000001B2F4EB0000-0x000001B2F4EC0000-memory.dmp
memory/3836-8-0x000001B2F4EB0000-0x000001B2F4EC0000-memory.dmp
memory/3836-9-0x000001B2F4EB0000-0x000001B2F4EC0000-memory.dmp