Analysis
- max time kernel
149s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/07/2026, 14:11
General
- Target 35f6b5905b4995c50de76e54a05e644e9d384ec0101e7160685d57df9e831584.exe
- Size 845KB
- Sample260712-rhdfcabt3q
- SHA256 35f6b5905b4995c50de76e54a05e644e9d384ec0101e7160685d57df9e831584
Malware Config
Extracted
-
xworm
-
XWorm V7.4
-
216.250.250.247:8086
-
Install_directory
%AppData%
-
install_file
XWormClient.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Drops startup file 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\35f6b5905b4995c50de76e54a05e644e9d384ec0101e7160685d57df9e831584.exe"C:\Users\Admin\AppData\Local\Temp\35f6b5905b4995c50de76e54a05e644e9d384ec0101e7160685d57df9e831584.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\35f6b5905b4995c50de76e54a05e644e9d384ec0101e7160685d57df9e831584.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\35f6b5905b4995c50de76e54a05e644e9d384ec0101e7160685d57df9e831584.exe"C:\Users\Admin\AppData\Local\Temp\35f6b5905b4995c50de76e54a05e644e9d384ec0101e7160685d57df9e831584.exe"2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1124-11-0x0000000000400000-0x0000000000418000-memory.dmp
memory/1124-45-0x0000000074F10000-0x00000000756CC000-memory.dmp
memory/1124-44-0x0000000074F10000-0x00000000756CC000-memory.dmp
memory/1124-31-0x0000000074F10000-0x00000000756CC000-memory.dmp
memory/1124-12-0x0000000074F10000-0x00000000756CC000-memory.dmp
memory/3308-33-0x00000000711F0000-0x000000007123C000-memory.dmp
memory/3308-20-0x0000000005F80000-0x0000000005FE6000-memory.dmp
memory/3308-43-0x0000000074F10000-0x00000000756CC000-memory.dmp
memory/3308-41-0x0000000007AE0000-0x0000000007B76000-memory.dmp
memory/3308-40-0x00000000078E0000-0x00000000078EA000-memory.dmp
memory/3308-39-0x0000000007870000-0x000000000788A000-memory.dmp
memory/3308-38-0x0000000007EB0000-0x000000000852C000-memory.dmp
memory/3308-37-0x0000000007540000-0x00000000075E3000-memory.dmp
memory/3308-13-0x0000000002CD0000-0x0000000002D06000-memory.dmp
memory/3308-15-0x0000000074F10000-0x00000000756CC000-memory.dmp
memory/3308-16-0x00000000058C0000-0x0000000005F0A000-memory.dmp
memory/3308-36-0x0000000006AF0000-0x0000000006B10000-memory.dmp
memory/3308-17-0x0000000074F10000-0x00000000756CC000-memory.dmp
memory/3308-18-0x0000000074F10000-0x00000000756CC000-memory.dmp
memory/3308-23-0x0000000005FF0000-0x0000000006056000-memory.dmp
memory/3308-32-0x0000000007500000-0x0000000007536000-memory.dmp
memory/3308-19-0x0000000005850000-0x0000000005872000-memory.dmp
memory/3308-24-0x0000000006060000-0x00000000063BB000-memory.dmp
memory/3308-25-0x0000000006500000-0x000000000651E000-memory.dmp
memory/3308-26-0x0000000006AA0000-0x0000000006AEC000-memory.dmp
memory/5272-3-0x0000000005620000-0x00000000056B2000-memory.dmp
memory/5272-6-0x00000000090D0000-0x00000000090EE000-memory.dmp
memory/5272-0-0x0000000074F22000-0x0000000074F23000-memory.dmp
memory/5272-14-0x0000000074F10000-0x00000000756CC000-memory.dmp
memory/5272-4-0x00000000055B0000-0x00000000055BA000-memory.dmp
memory/5272-5-0x0000000074F10000-0x00000000756CC000-memory.dmp
memory/5272-10-0x00000000095C0000-0x000000000965C000-memory.dmp
memory/5272-9-0x0000000009470000-0x000000000951A000-memory.dmp
memory/5272-8-0x0000000074F10000-0x00000000756CC000-memory.dmp
memory/5272-7-0x0000000074F22000-0x0000000074F23000-memory.dmp
memory/5272-2-0x0000000005BE0000-0x000000000619A000-memory.dmp
memory/5272-1-0x00000000009A0000-0x0000000000A7A000-memory.dmp