Analysis
- user interaction
yes - max time kernel
149s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 08:34
Behavioral task
behavioral1
Sample
koch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
150 seconds
General
- Target koch.exe
- Size 168KB
- Sample260718-kgtmlshs7z
- SHA256 d6cdc34803e1498b20f985bacf621844b244e5cd36f1dd9b450daf745b2d089a
- MD5 88ff9aa3ab31eab2c40a3e536f060c2c
- SHA1 839925370037870873ae3cd4b2aa554330649f90
- SHA512 47606d2711bdc6ea201f14a1212524234fc2b8adc847c4686717a5342d9f04e4cbb016c8340ffd50640dca65d3e716745581b36ee7f7d1e34296b588c810012e
- SSDEEP 3072:3X5sGGsxTfMuhNWBP3g7J1/UbwOMwMx2U2ah12B+hyojKJ:3X7HTnhNc3gF1cbLMt4Yhfj
- TLSH T14BF3AD4DB7B2DD09C65C4D338523808C42BEE5A7B457F76B25C86FE9FC2248C9A8B581
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detect Xworm Payload 1 IoCs
resource yara_rule behavioral2/memory/4960-1-0x0000000000F00000-0x0000000000F30000-memory.dmp family_xworm - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5476 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4960 koch.exe Token: SeDebugPrivilege 5476 taskmgr.exe Token: SeSystemProfilePrivilege 5476 taskmgr.exe Token: SeCreateGlobalPrivilege 5476 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe 5476 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5476 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\koch.exe"C:\Users\Admin\AppData\Local\Temp\koch.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4960
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4860