Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
05/07/2026, 00:21
General
- Target 5556.exe
- Size 39KB
- Sample260705-anvs5sbs6p
- SHA256 3f980de6bd0581609105f594ba932e5e54a9eb1afac81d7543a3a4da8aac9a6e
Score
10/10
Malware Config
Extracted
Family
-
xworm
Version
-
5.0
C2
-
188.212.158.75:7000
Mutex
-
XHqdiaq04Qd2gAKy
Attributes
-
install_file
USB.exe
aes.plain
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5556.exe"C:\Users\Admin\AppData\Local\Temp\5556.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/8-0-0x00007FFFBE64F000-0x00007FFFBE650000-memory.dmp
memory/8-1-0x0000000000830000-0x0000000000840000-memory.dmp
memory/8-2-0x00007FFFBE4C0000-0x00007FFFBEE64000-memory.dmp
memory/8-3-0x00007FFFBE4C0000-0x00007FFFBEE64000-memory.dmp
memory/8-4-0x00007FFFBE4C0000-0x00007FFFBEE64000-memory.dmp