Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/07/2026, 17:05
General
- Target Factura n 679 del 24072026.exe
- Size 788KB
- Sample260727-vl9vhaam21
- SHA256 1c067af5665a62e9251484c94bd2e2cbc734f97cf1c7243f62199abfabf43d19
Malware Config
Extracted
-
xworm
-
5.0
-
carrenzaalwarex.ddns.net:7004
-
2B7HLE7nXIzGq07o
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 28 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Factura n 679 del 24072026.exe"C:\Users\Admin\AppData\Local\Temp\Factura n 679 del 24072026.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Factura n 679 del 24072026.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\5uxjsxfhbqj.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\UtwVmYyGpij.exe"C:\Users\Admin\AppData\Roaming\UtwVmYyGpij.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UtwVmYyGpij.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
5uxjsxfhbqj.ps1
__PSScriptPolicyTest_eeel4xus.44c.ps1
UtwVmYyGpij.exe
memory/2188-35-0x0000000007890000-0x00000000078C6000-memory.dmp
memory/2188-27-0x00000000066F0000-0x000000000673C000-memory.dmp
memory/2188-36-0x0000000075460000-0x00000000754AC000-memory.dmp
memory/2188-47-0x0000000074BA0000-0x000000007535C000-memory.dmp
memory/2188-44-0x0000000007CB0000-0x0000000007D46000-memory.dmp
memory/2188-43-0x0000000007A80000-0x0000000007A8A000-memory.dmp
memory/2188-41-0x0000000008050000-0x00000000086CC000-memory.dmp
memory/2188-12-0x0000000002E80000-0x0000000002EB6000-memory.dmp
memory/2188-13-0x0000000074BA0000-0x000000007535C000-memory.dmp
memory/2188-16-0x0000000074BA0000-0x000000007535C000-memory.dmp
memory/2188-15-0x0000000074BA0000-0x000000007535C000-memory.dmp
memory/2188-39-0x0000000007870000-0x0000000007890000-memory.dmp
memory/2188-14-0x0000000005AC0000-0x000000000610A000-memory.dmp
memory/2188-18-0x00000000058B0000-0x00000000058D2000-memory.dmp
memory/2188-20-0x0000000005A50000-0x0000000005AB6000-memory.dmp
memory/2188-19-0x0000000005970000-0x00000000059D6000-memory.dmp
memory/2188-42-0x0000000007A10000-0x0000000007A2A000-memory.dmp
memory/2188-24-0x0000000006150000-0x00000000064AB000-memory.dmp
memory/2188-40-0x00000000078D0000-0x0000000007973000-memory.dmp
memory/2188-26-0x0000000006690000-0x00000000066AE000-memory.dmp
memory/2248-31-0x000001E82BCB0000-0x000001E82BCD2000-memory.dmp
memory/3096-17-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3096-23-0x0000000074BA0000-0x000000007535C000-memory.dmp
memory/3096-28-0x0000000074BA0000-0x000000007535C000-memory.dmp
memory/3096-49-0x0000000074BA0000-0x000000007535C000-memory.dmp
memory/3096-48-0x0000000074BA0000-0x000000007535C000-memory.dmp
memory/4948-59-0x0000000007C70000-0x0000000007D13000-memory.dmp
memory/4948-56-0x0000000070CD0000-0x0000000070D1C000-memory.dmp
memory/4948-55-0x0000000006EF0000-0x0000000006F3C000-memory.dmp
memory/4948-53-0x0000000006330000-0x000000000668B000-memory.dmp
memory/5920-5-0x0000000074BA0000-0x000000007535C000-memory.dmp
memory/5920-10-0x0000000007710000-0x00000000077BE000-memory.dmp
memory/5920-9-0x0000000007650000-0x00000000076EC000-memory.dmp
memory/5920-8-0x0000000074BA0000-0x000000007535C000-memory.dmp
memory/5920-1-0x00000000002F0000-0x00000000003BC000-memory.dmp
memory/5920-7-0x0000000074BB2000-0x0000000074BB3000-memory.dmp
memory/5920-0-0x0000000074BB2000-0x0000000074BB3000-memory.dmp
memory/5920-25-0x0000000074BA0000-0x000000007535C000-memory.dmp
memory/5920-6-0x0000000007560000-0x000000000756C000-memory.dmp
memory/5920-2-0x00000000055B0000-0x0000000005B6A000-memory.dmp
memory/5920-3-0x0000000004EE0000-0x0000000004F72000-memory.dmp
memory/5920-4-0x0000000004F80000-0x0000000004F8A000-memory.dmp