Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
08/07/2026, 22:25
General
- Target dialer11.exe
- Size 41KB
- Sample260708-2cerbsay9w
- SHA256 ccfabc5e99fe84655488d893420a171522fdba8ad9ad53d01d0087d829aa1bc5
Malware Config
Extracted
-
xworm
-
159.223.110.159:3764
-
ILzSkAL8i3X4NDka
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Drops startup file 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dialer11.exe"C:\Users\Admin\AppData\Local\Temp\dialer11.exe"1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2364-0-0x00007FFB9E5CF000-0x00007FFB9E5D0000-memory.dmp
memory/2364-1-0x0000000000D40000-0x0000000000D50000-memory.dmp
memory/2364-2-0x00007FFB9E440000-0x00007FFB9EDE4000-memory.dmp
memory/2364-3-0x00007FFB9E440000-0x00007FFB9EDE4000-memory.dmp
memory/2364-4-0x00007FFB9E440000-0x00007FFB9EDE4000-memory.dmp
memory/2364-5-0x00007FFB9E440000-0x00007FFB9EDE4000-memory.dmp
memory/2364-6-0x00007FFB9E440000-0x00007FFB9EDE4000-memory.dmp
memory/2364-7-0x00007FFB9E440000-0x00007FFB9EDE4000-memory.dmp
memory/2364-8-0x00007FFB9E440000-0x00007FFB9EDE4000-memory.dmp
memory/2364-9-0x00007FFB9E440000-0x00007FFB9EDE4000-memory.dmp
memory/2364-10-0x00007FFB9E440000-0x00007FFB9EDE4000-memory.dmp
memory/2364-11-0x00007FFB9E440000-0x00007FFB9EDE4000-memory.dmp
memory/2364-12-0x00007FFB9E440000-0x00007FFB9EDE4000-memory.dmp