Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/07/2026, 04:21
General
- Target 91d57a66876b61cfb6a4cebf5aeb4dca024dbcaa70502e396348ed77c23b8684.exe
- Size 732KB
- Sample260720-eypgbshv8x
- SHA256 91d57a66876b61cfb6a4cebf5aeb4dca024dbcaa70502e396348ed77c23b8684
Malware Config
Extracted
-
xworm
-
5.0
-
31.56.209.14:8200
-
hycXl3rsZdov9699
-
Install_directory
%AppData%
-
install_file
windows.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Drops startup file 2 IoCs
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- SmartAssembly .NET packer 2 IoCs
Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\91d57a66876b61cfb6a4cebf5aeb4dca024dbcaa70502e396348ed77c23b8684.exe"C:\Users\Admin\AppData\Local\Temp\91d57a66876b61cfb6a4cebf5aeb4dca024dbcaa70502e396348ed77c23b8684.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\91d57a66876b61cfb6a4cebf5aeb4dca024dbcaa70502e396348ed77c23b8684.exe"C:\Users\Admin\AppData\Local\Temp\91d57a66876b61cfb6a4cebf5aeb4dca024dbcaa70502e396348ed77c23b8684.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\91d57a66876b61cfb6a4cebf5aeb4dca024dbcaa70502e396348ed77c23b8684.exe"C:\Users\Admin\AppData\Local\Temp\91d57a66876b61cfb6a4cebf5aeb4dca024dbcaa70502e396348ed77c23b8684.exe"2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\sb5itazchkz.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\iwKftAUxZomdb.exe"C:\Users\Admin\AppData\Roaming\iwKftAUxZomdb.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\iwKftAUxZomdb.exe"C:\Users\Admin\AppData\Roaming\iwKftAUxZomdb.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
sb5itazchkz.ps1
iwKftAUxZomdb.exe
memory/2876-27-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/2876-21-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/2876-31-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/2876-30-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/2876-17-0x0000012974710000-0x0000012974732000-memory.dmp
memory/2876-26-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/2876-20-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/2876-24-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/2876-22-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/2876-25-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/2876-16-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/2876-15-0x00007FFEBC44F000-0x00007FFEBC450000-memory.dmp
memory/3624-33-0x00000000057F0000-0x0000000005804000-memory.dmp
memory/4304-13-0x0000000074710000-0x0000000074ECC000-memory.dmp
memory/4304-39-0x0000000005110000-0x0000000005120000-memory.dmp
memory/4304-12-0x0000000000400000-0x000000000040E000-memory.dmp
memory/4304-38-0x0000000074710000-0x0000000074ECC000-memory.dmp
memory/4304-37-0x0000000005110000-0x0000000005120000-memory.dmp
memory/4956-7-0x0000000004DF0000-0x0000000004E04000-memory.dmp
memory/4956-14-0x0000000074710000-0x0000000074ECC000-memory.dmp
memory/4956-9-0x0000000074710000-0x0000000074ECC000-memory.dmp
memory/4956-3-0x0000000004C90000-0x0000000004D22000-memory.dmp
memory/4956-5-0x0000000004E30000-0x0000000004ECC000-memory.dmp
memory/4956-1-0x0000000000030000-0x00000000000EE000-memory.dmp
memory/4956-6-0x0000000074710000-0x0000000074ECC000-memory.dmp
memory/4956-4-0x0000000004C10000-0x0000000004C1A000-memory.dmp
memory/4956-2-0x0000000005250000-0x000000000580A000-memory.dmp
memory/4956-10-0x0000000006380000-0x0000000006422000-memory.dmp
memory/4956-0-0x0000000074722000-0x0000000074723000-memory.dmp
memory/4956-8-0x0000000074722000-0x0000000074723000-memory.dmp