Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
01/07/2026, 15:59
General
- Target Obfuscated/XWormClient.exe
- Size 110KB
- Sample260701-tfa9babv9t
- SHA256 ba8059370df82d33b74fdf9033230d402ab33ead16b5f6b8eec755daf3517277
Malware Config
Signatures
- Drops startup file 2 IoCs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Obfuscated\XWormClient.exe"C:\Users\Admin\AppData\Local\Temp\Obfuscated\XWormClient.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\XWormClient.exeC:\Users\Admin\AppData\Local\XWormClient.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
XWormClient.exe
memory/3088-12-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/3088-13-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/3088-14-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/4160-0-0x00007FFF8F65F000-0x00007FFF8F660000-memory.dmp
memory/4160-1-0x0000000000990000-0x00000000009B2000-memory.dmp
memory/4160-2-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/4160-3-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/4160-4-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/4160-9-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/4160-15-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/4160-16-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp