Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 00:56
General
- Target 2026-06-04_c2d5bb8041720257381220ff26d0c453_cobalt-strike_icedid_satacom_vidar.exe
- Size 594KB
- Sample260604-batvcshv6j
- SHA256 d1bc352e8e6a27ac8cef3fb6252f7b371e7b66aa7b6abbb17e04acb8489c021c
Score
10/10
Malware Config
Extracted
Family
-
xworm
Version
-
5.0
Mutex
-
3OhSrOhREIKGzh5z
Attributes
-
install_file
USB.exe
-
localhost
127.0.0.1
aes.plain
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Detects Windows executables referencing non-Windows User-Agents 1 IoCs
- Drops file in Drivers directory 1 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_c2d5bb8041720257381220ff26d0c453_cobalt-strike_icedid_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_c2d5bb8041720257381220ff26d0c453_cobalt-strike_icedid_satacom_vidar.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\drivers\nv_disp.sysC:\Windows\System32\drivers\nv_disp.sys1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
nv_disp.sys
memory/5024-4-0x00000140581B0000-0x00000140581C0000-memory.dmp
memory/5024-3-0x00000140581B0000-0x00000140581C0000-memory.dmp
memory/5024-2-0x00000140581B0000-0x00000140581C0000-memory.dmp
memory/5024-1-0x00000140580D0000-0x000001405813A000-memory.dmp
memory/5024-6-0x00000140581B0000-0x00000140581C0000-memory.dmp
memory/5024-7-0x00000140581B0000-0x00000140581C0000-memory.dmp
memory/5024-8-0x00000140581B0000-0x00000140581C0000-memory.dmp