Analysis
- max time kernel
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
05/06/2026, 22:17
General
- Target 2026-06-05_597a2aadce100234d3396d9ccd242f2f_cobalt-strike_icedid_satacom_vidar.exe
- Size 936KB
- Sample260605-17rtpset8x
- SHA256 e052458a61261e660d51eae658b1e50cf90a00a33bd634da13fae7f6d12ca3ef
Score
10/10
Malware Config
Extracted
Family
-
xworm
Version
-
5.0
Mutex
-
3OhSrOhREIKGzh5z
Attributes
-
install_file
USB.exe
-
localhost
127.0.0.1
aes.plain
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 2 IoCs
- Detects Windows executables referencing non-Windows User-Agents 1 IoCs
- Drops file in Drivers directory 1 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-05_597a2aadce100234d3396d9ccd242f2f_cobalt-strike_icedid_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-05_597a2aadce100234d3396d9ccd242f2f_cobalt-strike_icedid_satacom_vidar.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\drivers\mshda_v2.sysC:\Windows\System32\drivers\mshda_v2.sys1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
mshda_v2.sys
memory/2888-4-0x000001BABF140000-0x000001BABF150000-memory.dmp
memory/2888-2-0x000001BAA5510000-0x000001BAA557A000-memory.dmp
memory/2888-3-0x000001BABF140000-0x000001BABF150000-memory.dmp
memory/2888-5-0x000001BABF140000-0x000001BABF150000-memory.dmp
memory/2888-7-0x000001BABF140000-0x000001BABF150000-memory.dmp
memory/2888-8-0x000001BABF140000-0x000001BABF150000-memory.dmp
memory/2888-6-0x000001BABF140000-0x000001BABF150000-memory.dmp