Analysis
- user interaction
yes - max time kernel
140s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
26/06/2026, 04:42
General
- Target XClient.exe
- Size 30KB
- Sample260626-fb2c2shw7m
- SHA256 104d18c3a36984e0f906508005d4ab014ab7d98568bbf3f388babe3ebf1560d9
Malware Config
Extracted
-
xworm
-
3.0
-
hjgf-33623.portmap.host:33623
-
XAWfbxXXzrop48if
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Disables Task Manager via registry modification
- Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 7 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\gmqhny.COM"C:\Users\Admin\AppData\Local\Temp\gmqhny.COM"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MBR2.exe"C:\Users\Admin\AppData\Local\Temp\MBR2.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\MatrixMBR.exe"C:\Windows\System32\MatrixMBR.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GDI.exe"C:\Users\Admin\AppData\Local\Temp\GDI.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\MBR.exe"C:\Users\Admin\AppData\Local\Temp\MBR.exe"5⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\TROLL5.exe"C:\Users\Admin\AppData\Local\Temp\TROLL5.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\TROLL2.exe"C:\Users\Admin\AppData\Local\Temp\TROLL2.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4b0 0x3041⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
GDI.exe
MBR.exe
MBR2.exe
TROLL2.exe
TROLL5.exe
gmqhny.COM
MatrixMBR.exe
memory/676-65-0x0000000000400000-0x000000000041D000-memory.dmp
memory/2024-3-0x00000000026B0000-0x00000000026BA000-memory.dmp
memory/2024-0-0x0000000000620000-0x000000000062E000-memory.dmp
memory/2024-2-0x000000001B220000-0x000000001B230000-memory.dmp
memory/2024-1-0x000000001B220000-0x000000001B230000-memory.dmp
memory/3060-64-0x0000000000250000-0x0000000000296000-memory.dmp
memory/3508-86-0x0000000000FF0000-0x0000000000FF8000-memory.dmp
memory/3944-28-0x0000000000E30000-0x0000000000E6A000-memory.dmp
memory/4252-49-0x0000000004E40000-0x0000000004E4A000-memory.dmp
memory/4252-48-0x0000000004E90000-0x0000000004F22000-memory.dmp
memory/4252-47-0x00000000053A0000-0x0000000005944000-memory.dmp
memory/4252-46-0x0000000000370000-0x0000000000428000-memory.dmp
memory/5036-11-0x000000001B9D0000-0x000000001BAB4000-memory.dmp
memory/5036-10-0x000000001B9C0000-0x000000001B9D0000-memory.dmp
memory/5036-9-0x0000000000B60000-0x0000000000C4C000-memory.dmp