Analysis
- max time kernel
148s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/07/2026, 04:48
General
- Target XClient.exe
- Size 32KB
- Sample260722-fe63psaf94
- SHA256 9c45065a82e7d1f22a714d7206967810f8d99b63e65bf12a386af387df118420
Malware Config
Extracted
-
xworm
-
5.0
-
DDDddddf-61485.portmap.host:61485
-
wre57jLhGEQOK6Jp
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3452-0-0x00007FFC72F2F000-0x00007FFC72F30000-memory.dmp
memory/3452-1-0x0000000000440000-0x000000000044E000-memory.dmp
memory/3452-2-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/3452-3-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/3452-4-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/3452-5-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/3452-6-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp
memory/3452-7-0x000000001B800000-0x000000001B8F0000-memory.dmp
memory/3452-8-0x000000001B800000-0x000000001B8F0000-memory.dmp
memory/3452-9-0x000000001B800000-0x000000001B8F0000-memory.dmp
memory/3452-10-0x000000001B800000-0x000000001B8F0000-memory.dmp
memory/3452-17-0x000000001B800000-0x000000001B8F0000-memory.dmp
memory/3452-18-0x00007FFC72DA0000-0x00007FFC73744000-memory.dmp