Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
12/07/2026, 12:19
General
- Target 09cf564075e4a500b6df3a3ca263076c47730b28d60c12fc59c7fd4e7464fa85.exe
- Size 825KB
- Sample260712-phfvcsbx3x
- SHA256 09cf564075e4a500b6df3a3ca263076c47730b28d60c12fc59c7fd4e7464fa85
Malware Config
Extracted
-
xworm
-
5.0
-
demagic009.duckdns.org:7007
-
S69qIxdj5LPiyiFB
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\09cf564075e4a500b6df3a3ca263076c47730b28d60c12fc59c7fd4e7464fa85.exe"C:\Users\Admin\AppData\Local\Temp\09cf564075e4a500b6df3a3ca263076c47730b28d60c12fc59c7fd4e7464fa85.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\09cf564075e4a500b6df3a3ca263076c47730b28d60c12fc59c7fd4e7464fa85.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\09cf564075e4a500b6df3a3ca263076c47730b28d60c12fc59c7fd4e7464fa85.exe"C:\Users\Admin\AppData\Local\Temp\09cf564075e4a500b6df3a3ca263076c47730b28d60c12fc59c7fd4e7464fa85.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\mvdpvogov2o.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\bmEiBJtlnfVV.exe"C:\Users\Admin\AppData\Roaming\bmEiBJtlnfVV.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bmEiBJtlnfVV.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\bmEiBJtlnfVV.exe"C:\Users\Admin\AppData\Roaming\bmEiBJtlnfVV.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bmEiBJtlnfVV.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ecghmru3.hdz.ps1
mvdpvogov2o.ps1
bmEiBJtlnfVV.exe
memory/2276-8-0x0000000007390000-0x0000000007432000-memory.dmp
memory/2276-7-0x00000000050A0000-0x00000000050B0000-memory.dmp
memory/2276-9-0x00000000074D0000-0x000000000756C000-memory.dmp
memory/2276-6-0x0000000006C80000-0x0000000006FD4000-memory.dmp
memory/2276-5-0x0000000006C60000-0x0000000006C80000-memory.dmp
memory/2276-0-0x00000000003E0000-0x00000000004B4000-memory.dmp
memory/2276-4-0x0000000004EA0000-0x0000000004EAA000-memory.dmp
memory/2276-3-0x00000000050A0000-0x00000000050B0000-memory.dmp
memory/2276-2-0x0000000004EC0000-0x0000000004F52000-memory.dmp
memory/2276-1-0x0000000005470000-0x0000000005A14000-memory.dmp
memory/2508-17-0x0000000002830000-0x0000000002866000-memory.dmp
memory/2508-62-0x00000000076B0000-0x00000000076C1000-memory.dmp
memory/2508-28-0x0000000005B60000-0x0000000005EB4000-memory.dmp
memory/2508-31-0x0000000006190000-0x00000000061AE000-memory.dmp
memory/2508-32-0x00000000061B0000-0x00000000061FC000-memory.dmp
memory/2508-16-0x00000000027E0000-0x00000000027F0000-memory.dmp
memory/2508-18-0x00000000027E0000-0x00000000027F0000-memory.dmp
memory/2508-22-0x00000000058F0000-0x0000000005956000-memory.dmp
memory/2508-20-0x0000000005040000-0x0000000005062000-memory.dmp
memory/2508-56-0x00000000067B0000-0x00000000067CE000-memory.dmp
memory/2508-48-0x0000000070DA0000-0x0000000070DEC000-memory.dmp
memory/2508-47-0x0000000006750000-0x0000000006782000-memory.dmp
memory/2508-57-0x0000000007180000-0x0000000007223000-memory.dmp
memory/2508-58-0x0000000007B00000-0x000000000817A000-memory.dmp
memory/2508-59-0x00000000074B0000-0x00000000074CA000-memory.dmp
memory/2508-60-0x0000000007520000-0x000000000752A000-memory.dmp
memory/2508-61-0x0000000007730000-0x00000000077C6000-memory.dmp
memory/2508-21-0x00000000050E0000-0x0000000005146000-memory.dmp
memory/2508-63-0x00000000076E0000-0x00000000076EE000-memory.dmp
memory/2508-64-0x00000000076F0000-0x0000000007704000-memory.dmp
memory/2508-65-0x00000000077F0000-0x000000000780A000-memory.dmp
memory/2508-66-0x00000000077D0000-0x00000000077D8000-memory.dmp
memory/2508-19-0x00000000052C0000-0x00000000058E8000-memory.dmp
memory/3808-82-0x0000000005AD0000-0x0000000005E24000-memory.dmp
memory/3808-84-0x00000000066A0000-0x00000000066EC000-memory.dmp
memory/3808-86-0x0000000071540000-0x000000007158C000-memory.dmp
memory/3808-94-0x00000000073B0000-0x0000000007453000-memory.dmp
memory/3808-95-0x0000000007690000-0x00000000076A1000-memory.dmp
memory/3808-96-0x00000000076D0000-0x00000000076E4000-memory.dmp
memory/4140-70-0x0000000005680000-0x0000000005690000-memory.dmp
memory/4140-33-0x0000000005680000-0x0000000005690000-memory.dmp
memory/4140-14-0x0000000000400000-0x000000000040E000-memory.dmp
memory/4380-34-0x00000249EB7B0000-0x00000249EB7D2000-memory.dmp